apisec-code-bolt 0.1.7__tar.gz → 0.1.9__tar.gz

{apisec_code_bolt-0.1.7 → apisec_code_bolt-0.1.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: apisec-code-bolt
-Version: 0.1.7
+Version: 0.1.9
 Summary: Static analysis probe for extracting architectural metadata from codebases
 Project-URL: Homepage, https://apisec.ai
 Project-URL: Documentation, https://docs.apisec.ai/code-bolt
@@ -291,8 +291,8 @@ Options:
 
 ### telemetry
 
-Manage anonymous, opt-in usage telemetry (disabled by default; never includes
-code, paths, or credentials).
+Manage anonymous usage telemetry (opt-out; on by default, disable any time with
+`telemetry off`; never includes code, paths, or credentials).
 
 ```bash
 apisec-code-bolt telemetry on|off|status
@@ -349,6 +349,48 @@ ruff check .
 ruff format --check .
 ```
 
+### Publishing a release (maintainers)
+
+The CLI is published to [PyPI](https://pypi.org/project/apisec-code-bolt/) by the
+**Publish to PyPI** GitHub Action. **Merging to `build` does NOT publish** — the
+workflow only runs on `workflow_dispatch` or a published GitHub Release, and it
+builds from whatever ref it runs on.
+
+Prerequisites (one-time): the `PYPI_API_TOKEN` repository secret must be set
+(Settings → Secrets and variables → Actions).
+
+1. **Bump the version.** Edit `version` in `pyproject.toml` (single source of
+   truth; `--version` reads it via package metadata). PyPI **rejects re-uploads**
+   of an existing version, so the number must be higher than the current PyPI
+   release. Open a PR and merge it to `build`.
+
+2. **Publish** — dispatch the workflow (the standard path we use):
+   Actions → *Publish to PyPI* → **Run workflow** → select branch **`build`**.
+
+   ```bash
+   gh workflow run "Publish to PyPI" --ref build
+   ```
+
+   <details><summary>Alternative: publish via a GitHub Release</summary>
+
+   New release → create tag `vX.Y.Z` → set **Target: `build`** (it defaults to
+   the default branch; only `build` has the bumped version) → Publish. This
+   fires the same workflow via `release: [published]`.
+
+   ```bash
+   gh release create vX.Y.Z --target build --title "vX.Y.Z" --notes "…"
+   ```
+   </details>
+
+3. **Verify.** Confirm the new version appears on
+   [PyPI](https://pypi.org/project/apisec-code-bolt/), then upgrade an install:
+   ```bash
+   uv tool upgrade apisec-code-bolt   # or: pipx upgrade apisec-code-bolt
+   ```
+
+> Always release from `build` after the version bump has merged there — releasing
+> from a ref that still carries the old version will fail the PyPI upload.
+
 ## Privacy
 
 apisec-code-bolt is designed with privacy as a core principle:

{apisec_code_bolt-0.1.7 → apisec_code_bolt-0.1.9}/README.md

@@ -244,8 +244,8 @@ Options:
 
 ### telemetry
 
-Manage anonymous, opt-in usage telemetry (disabled by default; never includes
-code, paths, or credentials).
+Manage anonymous usage telemetry (opt-out; on by default, disable any time with
+`telemetry off`; never includes code, paths, or credentials).
 
 ```bash
 apisec-code-bolt telemetry on|off|status
@@ -302,6 +302,48 @@ ruff check .
 ruff format --check .
 ```
 
+### Publishing a release (maintainers)
+
+The CLI is published to [PyPI](https://pypi.org/project/apisec-code-bolt/) by the
+**Publish to PyPI** GitHub Action. **Merging to `build` does NOT publish** — the
+workflow only runs on `workflow_dispatch` or a published GitHub Release, and it
+builds from whatever ref it runs on.
+
+Prerequisites (one-time): the `PYPI_API_TOKEN` repository secret must be set
+(Settings → Secrets and variables → Actions).
+
+1. **Bump the version.** Edit `version` in `pyproject.toml` (single source of
+   truth; `--version` reads it via package metadata). PyPI **rejects re-uploads**
+   of an existing version, so the number must be higher than the current PyPI
+   release. Open a PR and merge it to `build`.
+
+2. **Publish** — dispatch the workflow (the standard path we use):
+   Actions → *Publish to PyPI* → **Run workflow** → select branch **`build`**.
+
+   ```bash
+   gh workflow run "Publish to PyPI" --ref build
+   ```
+
+   <details><summary>Alternative: publish via a GitHub Release</summary>
+
+   New release → create tag `vX.Y.Z` → set **Target: `build`** (it defaults to
+   the default branch; only `build` has the bumped version) → Publish. This
+   fires the same workflow via `release: [published]`.
+
+   ```bash
+   gh release create vX.Y.Z --target build --title "vX.Y.Z" --notes "…"
+   ```
+   </details>
+
+3. **Verify.** Confirm the new version appears on
+   [PyPI](https://pypi.org/project/apisec-code-bolt/), then upgrade an install:
+   ```bash
+   uv tool upgrade apisec-code-bolt   # or: pipx upgrade apisec-code-bolt
+   ```
+
+> Always release from `build` after the version bump has merged there — releasing
+> from a ref that still carries the old version will fail the PyPI upload.
+
 ## Privacy
 
 apisec-code-bolt is designed with privacy as a core principle:

{apisec_code_bolt-0.1.7 → apisec_code_bolt-0.1.9}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "apisec-code-bolt"
-version = "0.1.7"
+version = "0.1.9"
 description = "Static analysis probe for extracting architectural metadata from codebases"
 readme = "README.md"
 license = {text = "Proprietary"}

{apisec_code_bolt-0.1.7 → apisec_code_bolt-0.1.9}/src/apisec_code_bolt/analysis/analyzer.py

@@ -790,16 +790,16 @@ class ProjectAnalyzer:
                             changed = True
 
             # Group-level auth: RequireAuthorization chained on the group
-            has_group_auth = any(
-                call.callee_name.split(".")[-1] == "RequireAuthorization"
-                and (call.receiver_expression or "").startswith("line:")
-                and (
-                    lambda rv=call.receiver_expression: (
-                        rv[5:].isdigit() and int(rv[5:]) in chain_lines
-                    )
-                )()
-                for call in parsed_file.call_sites
-            )
+            has_group_auth = False
+            for call in parsed_file.call_sites:
+                if call.callee_name.split(".")[-1] != "RequireAuthorization":
+                    continue
+                recv = call.receiver_expression or ""
+                if not recv.startswith("line:"):
+                    continue
+                if recv[5:].isdigit() and int(recv[5:]) in chain_lines:
+                    has_group_auth = True
+                    break
 
             # Find calls to custom Map* extension methods (non-standard, non-chained).
             # These are calls like ``group.MapCreateBrandEndpoint()`` where the method
@@ -2234,46 +2234,107 @@ class ProjectAnalyzer:
         Resolve handler qualified names to call graph symbols.
 
         Handles mismatches between route extraction and call graph naming
-        (e.g., module path variations).
+        (e.g., module path variations), and the interface-handler pattern where
+        the route annotations live on an interface method but the body lives in
+        an implementing class (e.g. Micronaut operation interfaces: routes are
+        declared on ``*Operations`` interfaces and the ``@Controller`` class
+        implements them). Taint must seed from the concrete implementation —
+        the interface method has no body, so a manifest handler pointing at it
+        yields zero data flows.
         """
         if not self._call_graph:
             return entry_points
 
-        symbols = set(self._call_graph._symbols.keys())
-        resolved = []
+        cg = self._call_graph
+        symbols = set(cg._symbols.keys())
 
+        # interface simple-name -> {implementing class qualified names}. Sourced
+        # from parsed classes (base_classes includes Java `implements`); the
+        # built CallGraph does not expose the builder's class-base map.
+        iface_impls: dict[str, set[str]] = {}
+        for pf in self._parsed_files.values():
+            if not getattr(pf, "success", False):
+                continue
+            for cls in getattr(pf, "classes", None) or []:
+                try:
+                    cls_qname = cls.qualified_name.full
+                except AttributeError:
+                    continue
+                for base in getattr(cls, "base_classes", None) or []:
+                    iface_impls.setdefault(base.rsplit(".", 1)[-1], set()).add(cls_qname)
+
+        def _redirect_to_impl(handler_qn: str) -> str:
+            """If handler is declared on an interface a concrete class implements,
+            redirect to that class's method (where the body/params live)."""
+            if "." not in handler_qn:
+                return handler_qn
+            owner, method = handler_qn.rsplit(".", 1)
+            impls = iface_impls.get(owner.rsplit(".", 1)[-1])
+            if not impls:
+                return handler_qn
+            fallback = None
+            for impl_cls in impls:
+                cand = f"{impl_cls}.{method}"
+                if cand == handler_qn or cand not in symbols:
+                    continue
+                node = cg.get_node(cand)
+                # Prefer a concrete implementation with a body (call edges) or one
+                # not flagged abstract; keep the interface handler otherwise.
+                if cg.get_callees(cand) or not getattr(node, "is_abstract", False):
+                    return cand
+                fallback = fallback or cand
+            return fallback or handler_qn
+
+        resolved = []
         for ep in entry_points:
             handler = ep.get("handler_qualified_name")
             if not handler:
                 resolved.append(ep)
                 continue
 
-            if handler in symbols:
-                resolved.append(ep)
-                continue
-
-            # Try common variations
-            candidates = [
-                handler,
-                handler.replace(".__init__", ""),
-            ]
-            # Try with/without package prefix (e.g., "app.main.get_user" -> "main.get_user")
-            if "." in handler:
-                parts = handler.split(".")
-                for i in range(1, len(parts)):
-                    variant = ".".join(parts[i:])
-                    if variant not in candidates:
-                        candidates.append(variant)
-
-            for cand in candidates:
-                if cand in symbols:
-                    ep = dict(ep)
-                    ep["handler_qualified_name"] = cand
-                    break
+            chosen = handler if handler in symbols else None
+            if chosen is None:
+                # Try common variations (module-path prefix stripping, __init__).
+                candidates = [handler, handler.replace(".__init__", "")]
+                if "." in handler:
+                    parts = handler.split(".")
+                    candidates += [".".join(parts[i:]) for i in range(1, len(parts))]
+                for cand in candidates:
+                    if cand in symbols:
+                        chosen = cand
+                        break
+                # Suffix match on the handler tail. Some plugins record the
+                # handler module as the *routing* file rather than the view's
+                # module (e.g. Django: `urls.UserSessionLoginApi.post` or the
+                # function-based `api_router.favorite_post`, while the symbols
+                # are `app.authentication.apis.UserSessionLoginApi.post` and
+                # `app.api.views.favorite_post`). Prefix stripping can't bridge
+                # that. Try the `Class.method` tail first, then the bare name,
+                # accepting a match only when it is unambiguous.
+                if chosen is None and "." in handler:
+                    parts = handler.split(".")
+                    for depth in (2, 1):
+                        if depth > len(parts):
+                            continue
+                        tail = "." + ".".join(parts[-depth:])
+                        tail_matches = [s for s in symbols if s.endswith(tail)]
+                        if len(tail_matches) == 1:
+                            chosen = tail_matches[0]
+                            break
+            chosen = chosen or handler
+
+            # Interface-handler → concrete implementation (Micronaut operation
+            # interfaces, and any handler declared on an implemented interface).
+            redirected = _redirect_to_impl(chosen)
+            if redirected != handler:
+                ep = dict(ep)
+                ep["handler_qualified_name"] = redirected
             resolved.append(ep)
 
         return resolved
 
+        return resolved
+
     # =========================================================================
     # Integration Detection
     # =========================================================================

{apisec_code_bolt-0.1.7 → apisec_code_bolt-0.1.9}/src/apisec_code_bolt/analysis/data_flow.py

@@ -1646,6 +1646,18 @@ class DataFlowAnalyzer:
                     if pname and ploc:
                         param_locations[pname] = ploc
 
+            # Django/DRF views receive all user input via the `request` object
+            # (request.data / .GET / .POST / .query_params) rather than typed
+            # per-field route params, so there is nothing in param_locations to
+            # seed. Treat the handler's `request` parameter itself as an HTTP
+            # origin and let propagation carry it into request.* reads, serializer
+            # construction, and downstream sinks.
+            if framework.startswith("django"):
+                for pobj in getattr(func, "parameters", None) or []:
+                    pname = getattr(pobj, "name", None)
+                    if pname == "request" and pname not in param_locations:
+                        param_locations[pname] = "HTTP_BODY"
+
             route_path = ep.get("path", "")
             origins = source_id.identify_from_function(
                 func,

{apisec_code_bolt-0.1.7 → apisec_code_bolt-0.1.9}/src/apisec_code_bolt/analysis/dependency_extractor.py

@@ -26,6 +26,25 @@ from ..parsing.base import ParsedFile
 logger = logging.getLogger(__name__)
 
 
+def _maven_bom_resolution_enabled() -> bool:
+    """Whether to resolve parent/imported Maven BOM versions from Maven Central.
+
+    Defaults ON: without it, deps whose versions are managed by a parent POM or
+    imported BOM (Spring Boot's jackson-databind, hsqldb, …) come back
+    version=None and are invisible to CVE matching. Resolution fetches those POMs
+    (network egress) and degrades cleanly to None on any failure.
+
+    Opt out for air-gapped / no-egress runs with ``--offline`` (sets
+    ``APISEC_OFFLINE``) or ``APISEC_RESOLVE_MAVEN_BOMS=0``.
+    """
+    if os.environ.get("APISEC_OFFLINE", "").strip().lower() in ("1", "true", "yes"):
+        return False
+    flag = os.environ.get("APISEC_RESOLVE_MAVEN_BOMS")
+    if flag is not None:
+        return flag.strip().lower() not in ("0", "false", "no", "")
+    return True
+
+
 class DependencyExtractor:
     """Extracts package dependencies and internal imports from a project."""
 
@@ -854,27 +873,75 @@ class DependencyExtractor:
 
     _MAVEN_CENTRAL = "https://repo1.maven.org/maven2"
     _bom_pom_cache: dict[str, bytes | None] = {}
+    _BOM_FETCH_ATTEMPTS = 3
+
+    def _bom_cache_dir(self) -> Path:
+        base = os.environ.get("APISEC_BOM_CACHE_DIR") or os.path.join(
+            os.path.expanduser("~"), ".cache", "apisec-code-bolt", "maven-boms"
+        )
+        return Path(base)
 
     def _fetch_pom(self, group: str, artifact: str, version: str) -> bytes | None:
-        """Fetch a POM from Maven Central (cached). None on any failure/offline."""
+        """Fetch a POM from Maven Central, resiliently. None on definitive miss
+        (404) or offline; a transient network failure is retried and NOT cached,
+        so a blip can't silently null out a managed version for the whole run.
+
+        Two cache tiers: an in-process dict and an on-disk cache. Version-pinned
+        POMs are immutable, so a cached copy is always valid — and it makes
+        resolution resilient to a flaky network (once fetched, reused forever).
+        """
         key = f"{group}:{artifact}:{version}"
         if key in self._bom_pom_cache:
             return self._bom_pom_cache[key]
+
+        cache_file = self._bom_cache_dir() / group.replace(".", "/") / artifact / f"{version}.pom"
+        try:
+            if cache_file.is_file():
+                data = cache_file.read_bytes()
+                self._bom_pom_cache[key] = data
+                return data
+        except Exception:  # unreadable cache file → fall through to fetch
+            pass
+
         url = (
             f"{self._MAVEN_CENTRAL}/{group.replace('.', '/')}/"
             f"{artifact}/{version}/{artifact}-{version}.pom"
         )
-        data: bytes | None = None
-        try:
-            import httpx
+        import time
+
+        for attempt in range(1, self._BOM_FETCH_ATTEMPTS + 1):
+            try:
+                import httpx
+
+                resp = httpx.get(url, timeout=8.0, follow_redirects=True)
+                if resp.status_code == 200:
+                    data = resp.content
+                    self._bom_pom_cache[key] = data
+                    try:  # best-effort persist; immutable so safe to keep
+                        cache_file.parent.mkdir(parents=True, exist_ok=True)
+                        cache_file.write_bytes(data)
+                    except Exception:
+                        pass
+                    return data
+                if resp.status_code == 404:
+                    self._bom_pom_cache[key] = None  # definitive miss; don't retry
+                    return None
+                # other statuses (5xx, 429, …) are transient → retry
+            except Exception as exc:  # network/transport → retry
+                logger.debug(
+                    "BOM POM fetch attempt %d/%d failed for %s: %s",
+                    attempt,
+                    self._BOM_FETCH_ATTEMPTS,
+                    key,
+                    exc,
+                )
+            if attempt < self._BOM_FETCH_ATTEMPTS:
+                time.sleep(0.5 * attempt)  # linear backoff
 
-            resp = httpx.get(url, timeout=8.0, follow_redirects=True)
-            if resp.status_code == 200:
-                data = resp.content
-        except Exception as exc:  # network/transport/anything → degrade to None
-            logger.debug("BOM POM fetch failed for %s: %s", key, exc)
-        self._bom_pom_cache[key] = data
-        return data
+        # Transient failure exhausted retries. Degrade to None but do NOT cache it,
+        # so a later call (or run) can retry rather than being poisoned to null.
+        logger.debug("BOM POM fetch exhausted retries for %s", key)
+        return None
 
     def _remote_managed_versions(
         self, seeds: list[tuple[str, str, str]], seed_props: dict[str, str]
@@ -921,7 +988,7 @@ class DependencyExtractor:
             pe = el.find(q("properties"))
             if pe is not None:
                 for c in pe:
-                    k = c.tag[len(ns):] if ns else c.tag
+                    k = c.tag[len(ns) :] if ns else c.tag
                     if c.text:
                         own[k] = c.text.strip()
             own.setdefault("project.version", v)
@@ -1100,15 +1167,16 @@ class DependencyExtractor:
             if parent_group and parent_artifact and parent_version:
                 parent_coord = (parent_group, parent_artifact, parent_version)
 
-        # Imported-BOM resolution (opt-in): third-party deps (h2, mysql, jackson…)
+        # Imported-BOM resolution (default ON): third-party deps (h2, mysql, jackson…)
         # get their versions from the parent chain / imported BOMs (e.g.
         # spring-boot-dependencies), NOT this file, so they'd otherwise be
-        # version=None → silently treated downstream as "not affected". When
-        # APISEC_RESOLVE_MAVEN_BOMS is set, fetch those POMs from Maven Central and
-        # resolve their pins; default off keeps the extractor offline/no-egress.
-        # Degrades cleanly to None on any fetch/parse failure.
+        # version=None → silently treated downstream as "not affected", hiding
+        # real CVEs. Fetch those POMs from Maven Central and resolve their pins;
+        # opt out for air-gapped runs via --offline (see
+        # _maven_bom_resolution_enabled). Degrades cleanly to None on any
+        # fetch/parse failure.
         remote_managed: dict[str, str] = {}
-        if os.environ.get("APISEC_RESOLVE_MAVEN_BOMS"):
+        if _maven_bom_resolution_enabled():
             seeds = ([parent_coord] if parent_coord else []) + import_boms
             if seeds:
                 remote_managed = self._remote_managed_versions(seeds, props)

{apisec_code_bolt-0.1.7 → apisec_code_bolt-0.1.9}/src/apisec_code_bolt/cli/main.py

@@ -6,6 +6,8 @@ This module defines the CLI commands using Click.
 
 from __future__ import annotations
 
+import contextlib
+import os
 import sys
 from pathlib import Path
 from typing import Any
@@ -150,7 +152,11 @@ def cli(ctx: click.Context, verbose: bool, quiet: bool, debug: bool, log_format:
 @click.option(
     "--timeout",
     type=int,
-    help="Analysis timeout in seconds.",
+    help=(
+        "Timeout in seconds for local analysis and, on upload, for waiting on "
+        "cloud verification. Large apps may need a higher value; a client "
+        "timeout never stops the analysis, which continues server-side."
+    ),
 )
 @click.option(
     "--dry-run",
@@ -163,6 +169,13 @@ def cli(ctx: click.Context, verbose: bool, quiet: bool, debug: bool, log_format:
     is_flag=True,
     help="Write manifest JSON to stdout instead of a file (for pipeline use).",
 )
+@click.option(
+    "--offline",
+    is_flag=True,
+    help="No network egress during extraction. Disables Maven BOM version "
+    "resolution (managed deps stay version=None, so their CVEs can't be matched). "
+    "Use for air-gapped runs.",
+)
 @click.pass_context
 def analyze(
     ctx: click.Context,
@@ -181,8 +194,14 @@ def analyze(
     timeout: int | None,
     dry_run: bool = False,
     output_stdout: bool = False,
+    offline: bool = False,
 ) -> None:
     log_format: str = ctx.obj.get("log_format", "text")
+    # Maven BOM version resolution is ON by default (resolves parent/BOM-managed
+    # dep versions so their CVEs are matchable). --offline opts out for
+    # no-egress environments; the extractor reads APISEC_OFFLINE.
+    if offline:
+        os.environ["APISEC_OFFLINE"] = "1"
     """
     Analyze a codebase and generate a manifest.
 
@@ -250,8 +269,6 @@ def analyze(
     )
 
     if needs_registration():
-        import os
-
         env_code = os.environ.get("APISEC_REGISTRATION_CODE", "").strip()
         if env_code:
             code = env_code
@@ -364,7 +381,7 @@ def analyze(
             output_path = apisec_dir / "manifest.json"
         manifest_json = result.manifest.to_json(pretty=True)
         output_path.parent.mkdir(parents=True, exist_ok=True)
-        output_path.write_text(manifest_json)
+        output_path.write_text(manifest_json, encoding="utf-8")
 
         if log_format == "json":
             _emit_json_summary(path, result, output_path=output_path)
@@ -428,6 +445,7 @@ def analyze(
                 api_url_override,
                 reasoning_url,
                 quiet,
+                verify_timeout=timeout,
             )
         elif cloud_url:
             # Legacy: direct connection to reasoning engine (for local dev)
@@ -517,6 +535,7 @@ def _run_authenticated_upload(
     api_url_override: str | None,
     reasoning_url_override: str | None,
     quiet: bool,
+    verify_timeout: int | None = None,
 ) -> None:
     """Register surface with applicationsservice (PAT), then upload manifest to the reasoning engine (same PAT + app_id)."""
     import json
@@ -580,11 +599,14 @@ def _run_authenticated_upload(
         write_state(project_path, RepoState(application_id=registration.app_id))
 
         manifest_data = json.loads(result.manifest.to_json())
+        upload_kwargs: dict[str, Any] = {"reasoning_engine_url": reasoning_url_override}
+        if verify_timeout:
+            upload_kwargs["max_wait"] = verify_timeout
         upload_result = client.upload_and_verify(
             registration,
             manifest_data,
             project_path,
-            reasoning_engine_url=reasoning_url_override,
+            **upload_kwargs,
         )
 
         if not quiet:
@@ -601,6 +623,14 @@ def _run_authenticated_upload(
                 vtable.add_row("Error", f"[red]{upload_result['error']}[/red]")
             console.print(vtable)
 
+            if upload_result.get("status") == "timeout":
+                console.print(
+                    "[yellow]Stopped waiting for verification, but the analysis is "
+                    "still running server-side[/yellow] — results will appear at the "
+                    "console link below shortly. This is common for large apps; pass "
+                    "[cyan]--timeout <seconds>[/cyan] to wait longer."
+                )
+
             console.print()
             view_url = _resolve_console_url(registration.console_url, registration.app_id)
             panel_body = view_url
@@ -1097,6 +1127,14 @@ cloud:
 
 def main() -> None:
     """Main entry point."""
+    # Force UTF-8 on stdio so non-ASCII manifest/JSON output (e.g. the U+2192
+    # arrow in data-flow output) does not crash on Windows consoles that
+    # default to cp1252.
+    for stream in (sys.stdout, sys.stderr):
+        reconfigure = getattr(stream, "reconfigure", None)
+        if reconfigure is not None:
+            with contextlib.suppress(ValueError, OSError):
+                reconfigure(encoding="utf-8")
     cli(obj={})
 
 

{apisec_code_bolt-0.1.7 → apisec_code_bolt-0.1.9}/src/apisec_code_bolt/cloud/apisec_client.py

@@ -106,8 +106,15 @@ class ApisecClient:
         manifest_data: dict[str, Any],
         project_root: Path,
         reasoning_engine_url: str | None = None,
+        max_wait: int = 900,
     ) -> dict[str, Any]:
-        """Upload manifest to reasoning engine with Bearer PAT and app_id; run verification."""
+        """Upload manifest to reasoning engine with Bearer PAT and app_id; run verification.
+
+        ``max_wait`` bounds how long the client polls for verification to
+        finish. Large apps (many endpoints / LLM verification) can legitimately
+        take several minutes, so this defaults generously; a client-side
+        timeout does not stop the analysis, which continues server-side.
+        """
         engine_url = reasoning_engine_url or self._api_url
         with CloudClient(
             api_url=engine_url,
@@ -120,7 +127,7 @@ class ApisecClient:
 
             maybe_enrich_manifest(manifest_data, project_root, client)
 
-            executor = QueryExecutor(project_root=project_root)
+            executor = QueryExecutor(project_root=project_root, max_wait=max_wait)
             result = executor.run_connected(client, manifest_data)
 
         return {

{apisec_code_bolt-0.1.7 → apisec_code_bolt-0.1.9}/src/apisec_code_bolt/core/telemetry.py

@@ -17,6 +17,7 @@ PII GUARD:
 from __future__ import annotations
 
 import logging
+import os
 import threading
 from pathlib import Path
 from typing import Any
@@ -267,8 +268,6 @@ def get_registration_code() -> str:
     Checks APISEC_REGISTRATION_CODE env var first so CI/automated environments
     can bypass the interactive first-run prompt without writing a config file.
     """
-    import os
-
     env_code = os.environ.get("APISEC_REGISTRATION_CODE", "").strip()
     if env_code:
         return env_code
@@ -335,7 +334,12 @@ def emit_install_event(*, probe_version: str = "") -> None:
     threading.Thread(target=_send, daemon=True).start()
 
 
-_TELEMETRY_ENDPOINT = "https://api.apisec.ai/v1/surface/telemetry/events"
+# Overridable for non-prod testing (staging/dev receivers), mirroring the
+# analyze path's --api-url. Defaults to prod, so unset means no change.
+_TELEMETRY_ENDPOINT = os.environ.get(
+    "APISEC_TELEMETRY_ENDPOINT",
+    "https://api.apisec.ai/v1/applications/surface/telemetry/events",
+)
 
 
 def emit_analyze_event(