@evalguardai/cli 1.1.0

package/dist/commands/list.js

@@ -0,0 +1,165 @@
+import chalk from "chalk";
+export function registerList(program) {
+    const list = program
+        .command("list")
+        .description("List available components");
+    // ─── list scorers ───
+    list
+        .command("scorers")
+        .description("List all built-in scorers")
+        .option("--json", "Output as JSON", false)
+        .action(async (opts) => {
+        const { BUILT_IN_SCORERS } = await import("@evalguard/core");
+        const scorers = Object.entries(BUILT_IN_SCORERS).map(([key, scorer]) => ({
+            name: key,
+            description: scorer.description ?? scorer.name,
+        }));
+        if (opts.json) {
+            console.log(JSON.stringify(scorers, null, 2));
+            return;
+        }
+        console.log();
+        console.log(chalk.bold(`  Available Scorers (${scorers.length})`));
+        console.log();
+        for (const s of scorers) {
+            console.log(`  ${chalk.cyan(s.name.padEnd(25))} ${chalk.dim(s.description)}`);
+        }
+        console.log();
+    });
+    // ─── list plugins ───
+    list
+        .command("plugins")
+        .description("List all red team attack plugins")
+        .option("--json", "Output as JSON", false)
+        .action(async (opts) => {
+        const { ALL_PLUGINS } = await import("@evalguard/core");
+        const plugins = ALL_PLUGINS.map((p) => ({
+            id: p.id,
+            name: p.name,
+            description: p.description,
+            severity: p.severity,
+            attackTypes: p.attackTypes,
+        }));
+        if (opts.json) {
+            console.log(JSON.stringify(plugins, null, 2));
+            return;
+        }
+        console.log();
+        console.log(chalk.bold(`  Attack Plugins (${plugins.length})`));
+        console.log();
+        for (const p of plugins) {
+            const sevColor = p.severity === "critical" ? chalk.red : p.severity === "high" ? chalk.yellow : chalk.dim;
+            console.log(`  ${chalk.cyan(p.id.padEnd(25))} ${sevColor(p.severity.padEnd(10))} ${chalk.dim(p.description)}`);
+        }
+        console.log();
+    });
+    // ─── list strategies ───
+    list
+        .command("strategies")
+        .description("List all encoding/obfuscation strategies")
+        .option("--json", "Output as JSON", false)
+        .action(async (opts) => {
+        const { ALL_STRATEGIES } = await import("@evalguard/core");
+        const strategies = ALL_STRATEGIES.map((s) => ({
+            id: s.id,
+            name: s.name,
+            description: s.description,
+        }));
+        if (opts.json) {
+            console.log(JSON.stringify(strategies, null, 2));
+            return;
+        }
+        console.log();
+        console.log(chalk.bold(`  Encoding Strategies (${strategies.length})`));
+        console.log();
+        for (const s of strategies) {
+            console.log(`  ${chalk.cyan(s.id.padEnd(25))} ${chalk.dim(s.description)}`);
+        }
+        console.log();
+    });
+    // ─── list graders ───
+    list
+        .command("graders")
+        .description("List all security graders")
+        .option("--json", "Output as JSON", false)
+        .action(async (opts) => {
+        const { ALL_GRADERS } = await import("@evalguard/core");
+        const graders = ALL_GRADERS.map((g) => ({
+            id: g.id,
+            name: g.name,
+            description: g.description,
+        }));
+        if (opts.json) {
+            console.log(JSON.stringify(graders, null, 2));
+            return;
+        }
+        console.log();
+        console.log(chalk.bold(`  Security Graders (${graders.length})`));
+        console.log();
+        for (const g of graders) {
+            console.log(`  ${chalk.cyan(g.id.padEnd(25))} ${chalk.dim(g.description)}`);
+        }
+        console.log();
+    });
+    // ─── list providers ───
+    list
+        .command("providers")
+        .description("List all supported LLM providers")
+        .option("--json", "Output as JSON", false)
+        .action(async (opts) => {
+        const { listProviders } = await import("@evalguard/core");
+        const providers = listProviders();
+        if (opts.json) {
+            console.log(JSON.stringify(providers, null, 2));
+            return;
+        }
+        console.log();
+        console.log(chalk.bold(`  Supported Providers (${providers.length})`));
+        console.log();
+        const categories = {
+            "Cloud AI": ["openai", "anthropic", "gemini", "mistral", "groq", "cohere", "ai21", "deepseek", "perplexity", "xai", "cerebras"],
+            "Cloud Platforms": ["azure-openai", "bedrock", "vertex", "sagemaker", "watsonx", "snowflake", "databricks"],
+            "Open Source / Local": ["ollama", "vllm", "localai", "llamafile", "llamacpp", "huggingface"],
+            "Gateways / Routers": ["openrouter", "litellm", "helicone", "portkey", "cloudflare"],
+            "Specialized": ["together", "fireworks", "replicate", "fal", "alibaba", "voyage", "github-models"],
+            "Utility": ["echo", "script", "sequence", "custom-http"],
+        };
+        for (const [category, ids] of Object.entries(categories)) {
+            const available = ids.filter((id) => providers.includes(id));
+            if (available.length === 0)
+                continue;
+            console.log(`  ${chalk.bold(category)}`);
+            for (const id of available) {
+                console.log(`    ${chalk.cyan(id)}`);
+            }
+            console.log();
+        }
+    });
+    // ─── list attacks ───
+    list
+        .command("attacks")
+        .description("List legacy attack types")
+        .option("--json", "Output as JSON", false)
+        .action(async (opts) => {
+        const { ATTACK_TYPES } = await import("@evalguard/core");
+        const attacks = ATTACK_TYPES.map((a) => ({
+            type: a.type,
+            name: a.name,
+            severity: a.severity,
+            payloadCount: a.payloads.length,
+        }));
+        if (opts.json) {
+            console.log(JSON.stringify(attacks, null, 2));
+            return;
+        }
+        console.log();
+        console.log(chalk.bold(`  Legacy Attack Types (${attacks.length})`));
+        console.log();
+        for (const a of attacks) {
+            const sevColor = a.severity === "critical" ? chalk.red : a.severity === "high" ? chalk.yellow : chalk.dim;
+            console.log(`  ${chalk.cyan(a.type.padEnd(25))} ${sevColor(a.severity.padEnd(10))} ${a.payloadCount} payloads`);
+        }
+        console.log();
+    });
+}
+//# sourceMappingURL=list.js.map

package/dist/commands/list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../src/commands/list.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,UAAU,YAAY,CAAC,OAAgB;IAC3C,MAAM,IAAI,GAAG,OAAO;SACjB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,2BAA2B,CAAC,CAAC;IAE5C,uBAAuB;IACvB,IAAI;SACD,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,2BAA2B,CAAC;SACxC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC;SACzC,MAAM,CAAC,KAAK,EAAE,IAAuB,EAAE,EAAE;QACxC,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAQ,CAAC;QAEpE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAgB,EAAE,EAAE,CAAC,CAAC;YACtF,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI;SAC/C,CAAC,CAAC,CAAC;QAEJ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,wBAAwB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACnE,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IAEL,uBAAuB;IACvB,IAAI;SACD,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,kCAAkC,CAAC;SAC/C,MAAM,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC;SACzC,MAAM,CAAC,KAAK,EAAE,IAAuB,EAAE,EAAE;QACxC,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAQ,CAAC;QAE/D,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YAC3C,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC,CAAC;QAEJ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;YAC1G,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACjH,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IAEL,0BAA0B;IAC1B,IAAI;SACD,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,0CAA0C,CAAC;SACvD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC;SACzC,MAAM,CAAC,KAAK,EAAE,IAAuB,EAAE,EAAE;QACxC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAQ,CAAC;QAElE,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YACjD,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC,CAAC;QAEJ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,0BAA0B,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IAEL,uBAAuB;IACvB,IAAI;SACD,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,2BAA2B,CAAC;SACxC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC;SACzC,MAAM,CAAC,KAAK,EAAE,IAAuB,EAAE,EAAE;QACxC,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAQ,CAAC;QAE/D,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YAC3C,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC,CAAC;QAEJ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uBAAuB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IAEL,yBAAyB;IACzB,IAAI;SACD,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,kCAAkC,CAAC;SAC/C,MAAM,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC;SACzC,MAAM,CAAC,KAAK,EAAE,IAAuB,EAAE,EAAE;QACxC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAQ,CAAC;QAEjE,MAAM,SAAS,GAAG,aAAa,EAAE,CAAC;QAElC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,0BAA0B,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,EAAE,CAAC;QAEd,MAAM,UAAU,GAA6B;YAC3C,UAAU,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,CAAC;YAC/H,iBAAiB,EAAE,CAAC,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,CAAC;YAC3G,qBAAqB,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,CAAC;YAC5F,oBAAoB,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,CAAC;YACpF,aAAa,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,CAAC;YAClG,SAAS,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,CAAC;SACzD,CAAC;QAEF,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACzD,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACrC,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACzC,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;gBAC3B,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACvC,CAAC;YACD,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,uBAAuB;IACvB,IAAI;SACD,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,0BAA0B,CAAC;SACvC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC;SACzC,MAAM,CAAC,KAAK,EAAE,IAAuB,EAAE,EAAE;QACxC,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAQ,CAAC;QAEhE,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YAC5C,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM;SAChC,CAAC,CAAC,CAAC;QAEJ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,0BAA0B,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrE,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;YAC1G,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,WAAW,CAAC,CAAC;QAClH,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/logs.d.ts

@@ -0,0 +1,6 @@
+/**
+ * `evalguard logs` — View recent eval/scan run logs
+ */
+import { Command } from "commander";
+export declare function registerLogs(program: Command): void;
+//# sourceMappingURL=logs.d.ts.map

package/dist/commands/logs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logs.d.ts","sourceRoot":"","sources":["../../src/commands/logs.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0CpC,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA0HnD"}

package/dist/commands/logs.js

@@ -0,0 +1,153 @@
+import chalk from "chalk";
+import * as fs from "fs";
+import * as path from "path";
+import * as os from "os";
+const LOG_DIR = path.join(os.homedir(), ".evalguard", "logs");
+function getLogFiles(type) {
+    if (!fs.existsSync(LOG_DIR))
+        return [];
+    const files = fs.readdirSync(LOG_DIR).filter((f) => f.endsWith(".log"));
+    if (type) {
+        return files.filter((f) => f.startsWith(type));
+    }
+    return files;
+}
+function tailFile(filePath, lines) {
+    if (!fs.existsSync(filePath))
+        return [];
+    const content = fs.readFileSync(filePath, "utf-8");
+    const allLines = content.split("\n");
+    return allLines.slice(-lines);
+}
+function formatLogLine(line) {
+    if (!line.trim())
+        return "";
+    // Colorize log levels
+    if (line.includes("[ERROR]") || line.includes("[FAIL]")) {
+        return chalk.red(line);
+    }
+    if (line.includes("[WARN]")) {
+        return chalk.yellow(line);
+    }
+    if (line.includes("[PASS]") || line.includes("[OK]")) {
+        return chalk.green(line);
+    }
+    if (line.includes("[INFO]")) {
+        return chalk.dim(line);
+    }
+    return line;
+}
+export function registerLogs(program) {
+    program
+        .command("logs")
+        .description("View recent eval/scan run logs")
+        .option("-n, --lines <n>", "Number of lines to show", "50")
+        .option("-f, --follow", "Follow log output (watch for new lines)", false)
+        .option("-t, --type <type>", "Filter by type: eval or scan")
+        .option("--list", "List available log files", false)
+        .action(async (opts) => {
+        // Ensure log directory exists
+        if (!fs.existsSync(LOG_DIR)) {
+            fs.mkdirSync(LOG_DIR, { recursive: true, mode: 0o700 });
+        }
+        const logFiles = getLogFiles(opts.type);
+        if (opts.list) {
+            if (logFiles.length === 0) {
+                console.log(chalk.dim("\n  No log files found.\n"));
+                return;
+            }
+            console.log();
+            console.log(chalk.bold("  Log Files"));
+            console.log(chalk.dim("  " + "-".repeat(60)));
+            for (const f of logFiles.sort().reverse()) {
+                const stat = fs.statSync(path.join(LOG_DIR, f));
+                const size = (stat.size / 1024).toFixed(1);
+                const date = stat.mtime.toLocaleString();
+                console.log(`  ${chalk.cyan(f.padEnd(40))} ${chalk.dim(`${size} KB`)}  ${chalk.dim(date)}`);
+            }
+            console.log();
+            return;
+        }
+        // Find the most recent log file
+        if (logFiles.length === 0) {
+            // Check results.json as a fallback log source
+            const resultsFile = path.join(os.homedir(), ".evalguard", "results.json");
+            if (fs.existsSync(resultsFile)) {
+                try {
+                    const runs = JSON.parse(fs.readFileSync(resultsFile, "utf-8"));
+                    const filteredRuns = opts.type
+                        ? runs.filter((r) => r.type === opts.type)
+                        : runs;
+                    const recentRuns = filteredRuns.slice(-parseInt(opts.lines, 10));
+                    if (recentRuns.length === 0) {
+                        console.log(chalk.dim("\n  No log entries found.\n"));
+                        return;
+                    }
+                    console.log();
+                    console.log(chalk.bold("  Recent Run Log"));
+                    console.log(chalk.dim("  " + "-".repeat(70)));
+                    for (const run of recentRuns.reverse()) {
+                        const passRate = run.passRate;
+                        const color = passRate >= 0.8 ? chalk.green : passRate >= 0.5 ? chalk.yellow : chalk.red;
+                        const icon = passRate >= 0.8 ? chalk.green("PASS") : chalk.red("FAIL");
+                        console.log(`  ${chalk.dim(run.timestamp)} [${icon}] ${chalk.bold(String(run.name).slice(0, 30))} ` +
+                            `${color((passRate * 100).toFixed(0) + "%")} ${chalk.dim(`(${run.model})`)}`);
+                    }
+                    console.log();
+                }
+                catch {
+                    console.log(chalk.dim("\n  No log entries found.\n"));
+                }
+            }
+            else {
+                console.log(chalk.dim("\n  No log files found. Run an eval or scan first.\n"));
+            }
+            return;
+        }
+        const latestFile = logFiles.sort().reverse()[0];
+        const logPath = path.join(LOG_DIR, latestFile);
+        const numLines = parseInt(opts.lines, 10);
+        console.log(chalk.dim(`  Reading ${latestFile}`));
+        console.log(chalk.dim("  " + "-".repeat(60)));
+        const lines = tailFile(logPath, numLines);
+        for (const line of lines) {
+            const formatted = formatLogLine(line);
+            if (formatted)
+                console.log(`  ${formatted}`);
+        }
+        if (opts.follow) {
+            console.log(chalk.dim("\n  Watching for new log entries... (Ctrl+C to stop)\n"));
+            let lastSize = fs.statSync(logPath).size;
+            const watcher = setInterval(() => {
+                try {
+                    const stat = fs.statSync(logPath);
+                    if (stat.size > lastSize) {
+                        const fd = fs.openSync(logPath, "r");
+                        const buf = Buffer.alloc(stat.size - lastSize);
+                        fs.readSync(fd, buf, 0, buf.length, lastSize);
+                        fs.closeSync(fd);
+                        const newLines = buf.toString("utf-8").split("\n");
+                        for (const line of newLines) {
+                            const formatted = formatLogLine(line);
+                            if (formatted)
+                                console.log(`  ${formatted}`);
+                        }
+                        lastSize = stat.size;
+                    }
+                }
+                catch {
+                    // File may have been rotated
+                }
+            }, 1000);
+            process.on("SIGINT", () => {
+                clearInterval(watcher);
+                console.log(chalk.dim("\n  Stopped watching.\n"));
+                process.exit(0);
+            });
+            // Keep the process alive
+            await new Promise(() => { });
+        }
+        console.log();
+    });
+}
+//# sourceMappingURL=logs.js.map

package/dist/commands/logs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logs.js","sourceRoot":"","sources":["../../src/commands/logs.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAEzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;AAE9D,SAAS,WAAW,CAAC,IAAa;IAChC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACxE,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB,EAAE,KAAa;IAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAC5B,sBAAsB;IACtB,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAgB;IAC3C,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,gCAAgC,CAAC;SAC7C,MAAM,CAAC,iBAAiB,EAAE,yBAAyB,EAAE,IAAI,CAAC;SAC1D,MAAM,CAAC,cAAc,EAAE,yCAAyC,EAAE,KAAK,CAAC;SACxE,MAAM,CAAC,mBAAmB,EAAE,8BAA8B,CAAC;SAC3D,MAAM,CAAC,QAAQ,EAAE,0BAA0B,EAAE,KAAK,CAAC;SACnD,MAAM,CAAC,KAAK,EAAE,IAAsE,EAAE,EAAE;QACvF,8BAA8B;QAC9B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAExC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YACD,OAAO,CAAC,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9C,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC1C,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;gBACzC,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,KAAK,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,OAAO,CAAC,GAAG,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QAED,gCAAgC;QAChC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,8CAA8C;YAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;YAC1E,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/B,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAmC,CAAC;oBACjG,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI;wBAC5B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC;wBAC1C,CAAC,CAAC,IAAI,CAAC;oBACT,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;oBAEjE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBAC5B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,CAAC;wBACtD,OAAO;oBACT,CAAC;oBAED,OAAO,CAAC,GAAG,EAAE,CAAC;oBACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;oBAC5C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;oBAC9C,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;wBACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAkB,CAAC;wBACxC,MAAM,KAAK,GAAG,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;wBACzF,MAAM,IAAI,GAAG,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;wBACvE,OAAO,CAAC,GAAG,CACT,KAAK,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,SAAmB,CAAC,KAAK,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG;4BACjG,GAAG,KAAK,CAAC,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,CAC7E,CAAC;oBACJ,CAAC;oBACD,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChB,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,CAAC;gBACxD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC,CAAC;YACjF,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAE1C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,UAAU,EAAE,CAAC,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAE9C,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC,CAAC;YACjF,IAAI,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;YAEzC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE;gBAC/B,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;oBAClC,IAAI,IAAI,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;wBACzB,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;wBACrC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,CAAC;wBAC/C,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;wBAC9C,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;wBACjB,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;wBACnD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;4BAC5B,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;4BACtC,IAAI,SAAS;gCAAE,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC;wBAC/C,CAAC;wBACD,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;oBACvB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,6BAA6B;gBAC/B,CAAC;YACH,CAAC,EAAE,IAAI,CAAC,CAAC;YAET,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;gBACxB,aAAa,CAAC,OAAO,CAAC,CAAC;gBACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC;gBAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;YAEH,yBAAyB;YACzB,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC9B,CAAC;QAED,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/model-scan.d.ts

@@ -0,0 +1,7 @@
+/**
+ * `evalguard model-scan` — Scan model files for backdoors/trojans
+ * Checks pickle, PyTorch (.pt/.pth), ONNX, and SafeTensors files
+ */
+import { Command } from "commander";
+export declare function registerModelScan(program: Command): void;
+//# sourceMappingURL=model-scan.d.ts.map

package/dist/commands/model-scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-scan.d.ts","sourceRoot":"","sources":["../../src/commands/model-scan.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA2MpC,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAwHxD"}

package/dist/commands/model-scan.js

@@ -0,0 +1,276 @@
+import chalk from "chalk";
+import * as fs from "fs";
+import * as path from "path";
+// Dangerous pickle opcodes that can execute arbitrary code
+const DANGEROUS_PICKLE_OPS = [
+    { bytes: Buffer.from([0x52]), name: "REDUCE", severity: "critical", desc: "Calls arbitrary callable with args" },
+    { bytes: Buffer.from([0x81]), name: "NEWOBJ", severity: "high", desc: "Creates new object instance" },
+    { bytes: Buffer.from([0x92]), name: "NEWOBJ_EX", severity: "high", desc: "Creates new object with kwargs" },
+    { bytes: Buffer.from([0x83]), name: "STACK_GLOBAL", severity: "critical", desc: "Pushes global by name from stack" },
+    { bytes: Buffer.from([0x63]), name: "GLOBAL", severity: "critical", desc: "Pushes global variable" },
+    { bytes: Buffer.from([0x69]), name: "INST", severity: "critical", desc: "Instantiates class" },
+    { bytes: Buffer.from([0x62]), name: "BUILD", severity: "medium", desc: "Calls __setstate__ or updates __dict__" },
+];
+// Suspicious Python imports commonly used in malicious pickles
+const SUSPICIOUS_IMPORTS = [
+    { pattern: "os.system", severity: "critical", desc: "System command execution" },
+    { pattern: "os.popen", severity: "critical", desc: "Process execution with pipe" },
+    { pattern: "subprocess", severity: "critical", desc: "Subprocess execution" },
+    { pattern: "builtins.eval", severity: "critical", desc: "Arbitrary code evaluation" },
+    { pattern: "builtins.exec", severity: "critical", desc: "Arbitrary code execution" },
+    { pattern: "builtins.__import__", severity: "critical", desc: "Dynamic module import" },
+    { pattern: "webbrowser", severity: "high", desc: "Browser launch capability" },
+    { pattern: "socket", severity: "high", desc: "Network socket access" },
+    { pattern: "http.client", severity: "high", desc: "HTTP client (data exfiltration)" },
+    { pattern: "urllib", severity: "high", desc: "URL handling (data exfiltration)" },
+    { pattern: "ctypes", severity: "high", desc: "C-level memory access" },
+    { pattern: "shutil.rmtree", severity: "critical", desc: "Recursive directory deletion" },
+    { pattern: "pickle.loads", severity: "medium", desc: "Nested pickle deserialization" },
+    { pattern: "marshal.loads", severity: "high", desc: "Marshal deserialization (code objects)" },
+    { pattern: "compile", severity: "medium", desc: "Code compilation" },
+    { pattern: "codecs.decode", severity: "medium", desc: "Potential obfuscation via codec" },
+];
+// Obfuscation indicators
+const OBFUSCATION_PATTERNS = [
+    { pattern: "\\x", severity: "medium", desc: "Hex-escaped bytes (potential obfuscation)" },
+    { pattern: "base64", severity: "medium", desc: "Base64 encoding (potential obfuscation)" },
+    { pattern: "zlib.decompress", severity: "medium", desc: "Compressed payload (potential obfuscation)" },
+    { pattern: "lambda", severity: "low", desc: "Lambda function in model data" },
+    { pattern: "exec(", severity: "critical", desc: "Direct exec call in model data" },
+    { pattern: "eval(", severity: "critical", desc: "Direct eval call in model data" },
+];
+const SEVERITY_ORDER = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
+function scanFile(filePath) {
+    const findings = [];
+    const ext = path.extname(filePath).toLowerCase();
+    const stat = fs.statSync(filePath);
+    // Read file (limit to first 50MB for very large models)
+    const maxRead = Math.min(stat.size, 50 * 1024 * 1024);
+    const fd = fs.openSync(filePath, "r");
+    const buf = Buffer.alloc(maxRead);
+    fs.readSync(fd, buf, 0, maxRead, 0);
+    fs.closeSync(fd);
+    const content = buf.toString("latin1"); // Binary-safe string
+    // Check file type
+    if (ext === ".safetensors") {
+        findings.push({
+            severity: "info",
+            type: "format",
+            message: "SafeTensors format detected - this is the safest model format (no code execution)",
+        });
+        // SafeTensors files should not contain executable code
+        for (const imp of SUSPICIOUS_IMPORTS) {
+            if (content.includes(imp.pattern)) {
+                findings.push({
+                    severity: "critical",
+                    type: "suspicious_import",
+                    message: `SafeTensors file contains suspicious string "${imp.pattern}" - ${imp.desc}`,
+                    offset: content.indexOf(imp.pattern),
+                });
+            }
+        }
+        return findings;
+    }
+    // Pickle/PyTorch scan
+    if ([".pkl", ".pickle", ".pt", ".pth", ".bin"].includes(ext)) {
+        // Check for pickle magic number
+        const hasPickleMagic = buf[0] === 0x80;
+        if (hasPickleMagic) {
+            findings.push({
+                severity: "info",
+                type: "format",
+                message: `Pickle format v${buf[1]} detected - pickle files can execute arbitrary code on load`,
+            });
+        }
+        // PyTorch files are ZIP archives containing pickles
+        const isZip = buf[0] === 0x50 && buf[1] === 0x4b;
+        if (isZip) {
+            findings.push({
+                severity: "info",
+                type: "format",
+                message: "PyTorch ZIP archive detected - contains pickle data that can execute code on load",
+            });
+        }
+        // Scan for dangerous pickle opcodes
+        for (const op of DANGEROUS_PICKLE_OPS) {
+            let idx = 0;
+            let count = 0;
+            while ((idx = buf.indexOf(op.bytes, idx)) !== -1) {
+                count++;
+                idx += 1;
+            }
+            if (count > 0) {
+                findings.push({
+                    severity: op.severity,
+                    type: "pickle_opcode",
+                    message: `${op.name} opcode found ${count}x - ${op.desc}`,
+                });
+            }
+        }
+        // Scan for suspicious imports
+        for (const imp of SUSPICIOUS_IMPORTS) {
+            const idx = content.indexOf(imp.pattern);
+            if (idx !== -1) {
+                const contextStart = Math.max(0, idx - 20);
+                const contextEnd = Math.min(content.length, idx + imp.pattern.length + 20);
+                const context = content.slice(contextStart, contextEnd).replace(/[^\x20-\x7e]/g, ".");
+                findings.push({
+                    severity: imp.severity,
+                    type: "suspicious_import",
+                    message: `Found "${imp.pattern}" - ${imp.desc}`,
+                    offset: idx,
+                    context,
+                });
+            }
+        }
+    }
+    // ONNX scan
+    if (ext === ".onnx") {
+        findings.push({
+            severity: "info",
+            type: "format",
+            message: "ONNX format detected - generally safer than pickle but can contain custom ops",
+        });
+        // Check for custom operators that could hide malicious code
+        if (content.includes("custom_op") || content.includes("CustomOp")) {
+            findings.push({
+                severity: "medium",
+                type: "custom_op",
+                message: "Custom operator detected - review for unexpected behavior",
+            });
+        }
+    }
+    // Universal obfuscation checks
+    for (const ob of OBFUSCATION_PATTERNS) {
+        const idx = content.indexOf(ob.pattern);
+        if (idx !== -1) {
+            findings.push({
+                severity: ob.severity,
+                type: "obfuscation",
+                message: `Found "${ob.pattern}" - ${ob.desc}`,
+                offset: idx,
+            });
+        }
+    }
+    return findings;
+}
+function scanDirectory(dirPath) {
+    const results = new Map();
+    const scanExtensions = new Set([".pkl", ".pickle", ".pt", ".pth", ".bin", ".onnx", ".safetensors"]);
+    function walk(dir) {
+        const entries = fs.readdirSync(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            const fullPath = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                walk(fullPath);
+            }
+            else if (scanExtensions.has(path.extname(entry.name).toLowerCase())) {
+                const findings = scanFile(fullPath);
+                results.set(fullPath, findings);
+            }
+        }
+    }
+    walk(dirPath);
+    return results;
+}
+export function registerModelScan(program) {
+    program
+        .command("model-scan")
+        .description("Scan model files for backdoors, trojans, and suspicious code")
+        .argument("<path>", "Path to model file or directory")
+        .option("-f, --format <format>", "Output format: text or json", "text")
+        .option("-s, --severity <level>", "Minimum severity to report: critical, high, medium, low, info", "low")
+        .action((targetPath, opts) => {
+        const resolved = path.resolve(targetPath);
+        if (!fs.existsSync(resolved)) {
+            console.error(chalk.red(`Path not found: ${resolved}`));
+            process.exit(1);
+        }
+        const minSeverity = SEVERITY_ORDER[opts.severity] ?? 3;
+        const stat = fs.statSync(resolved);
+        let allResults;
+        if (stat.isDirectory()) {
+            allResults = scanDirectory(resolved);
+        }
+        else {
+            allResults = new Map([[resolved, scanFile(resolved)]]);
+        }
+        if (allResults.size === 0) {
+            console.log(chalk.dim("\n  No scannable model files found (.pkl, .pt, .pth, .onnx, .safetensors)\n"));
+            return;
+        }
+        // Filter by severity
+        for (const [file, findings] of allResults) {
+            const filtered = findings.filter((f) => SEVERITY_ORDER[f.severity] <= minSeverity);
+            allResults.set(file, filtered);
+        }
+        // JSON output
+        if (opts.format === "json") {
+            const jsonOutput = [];
+            for (const [file, findings] of allResults) {
+                jsonOutput.push({
+                    file,
+                    findings: findings.map((f) => ({ ...f })),
+                    hasCritical: findings.some((f) => f.severity === "critical"),
+                    hasHigh: findings.some((f) => f.severity === "high"),
+                });
+            }
+            console.log(JSON.stringify(jsonOutput, null, 2));
+            return;
+        }
+        // Text output
+        console.log();
+        console.log(chalk.bold("  EvalGuard Model Security Scan"));
+        console.log(chalk.dim("  " + "-".repeat(70)));
+        let totalCritical = 0;
+        let totalHigh = 0;
+        let totalFindings = 0;
+        for (const [file, findings] of allResults) {
+            const relPath = path.relative(process.cwd(), file);
+            const critical = findings.filter((f) => f.severity === "critical").length;
+            const high = findings.filter((f) => f.severity === "high").length;
+            totalCritical += critical;
+            totalHigh += high;
+            totalFindings += findings.length;
+            const fileIcon = critical > 0 ? chalk.red("!!!") : high > 0 ? chalk.yellow("!!") : chalk.green("OK");
+            console.log();
+            console.log(`  ${fileIcon} ${chalk.bold(relPath)}`);
+            if (findings.length === 0) {
+                console.log(chalk.dim("      No issues found"));
+                continue;
+            }
+            // Sort findings by severity
+            const sorted = [...findings].sort((a, b) => SEVERITY_ORDER[a.severity] - SEVERITY_ORDER[b.severity]);
+            for (const f of sorted) {
+                const sevColor = f.severity === "critical" ? chalk.red.bold :
+                    f.severity === "high" ? chalk.red :
+                        f.severity === "medium" ? chalk.yellow :
+                            f.severity === "low" ? chalk.dim :
+                                chalk.dim;
+                const sevLabel = sevColor(f.severity.toUpperCase().padEnd(8));
+                console.log(`      ${sevLabel} ${f.message}`);
+                if (f.context) {
+                    console.log(chalk.dim(`               context: ...${f.context}...`));
+                }
+            }
+        }
+        // Summary
+        console.log();
+        console.log(chalk.dim("  " + "-".repeat(70)));
+        console.log(`  Scanned ${chalk.bold(String(allResults.size))} file(s), ` +
+            `${chalk.bold(String(totalFindings))} finding(s): ` +
+            `${totalCritical > 0 ? chalk.red.bold(`${totalCritical} critical`) : chalk.dim("0 critical")}, ` +
+            `${totalHigh > 0 ? chalk.red(`${totalHigh} high`) : chalk.dim("0 high")}`);
+        if (totalCritical > 0) {
+            console.log();
+            console.log(chalk.red.bold("  WARNING: Critical findings detected. Do NOT load this model without review."));
+            console.log(chalk.dim("  Consider using SafeTensors format instead of pickle-based formats."));
+        }
+        console.log();
+        // Exit code: 1 if critical findings
+        if (totalCritical > 0) {
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=model-scan.js.map