@xagents_in/unmask 0.1.2 → 0.1.3

package/README.md

@@ -1,31 +1,171 @@
+<div align="center">
+
 # UNMASK
 
-See what actually shipped.
+### See what actually shipped.
+
+**The code you review on GitHub is not the code you install from npm.**<br>
+UNMASK compares the two, byte for byte, and shows the evidence for every difference.
+
+[![npm](https://img.shields.io/npm/v/@xagents_in/unmask?color=dafa9c&labelColor=0f0f0f&label=npm)](https://www.npmjs.com/package/@xagents_in/unmask)
+[![License: MIT](https://img.shields.io/badge/license-MIT-dafa9c?labelColor=0f0f0f)](LICENSE)
+[![Node 24.22.2](https://img.shields.io/badge/node-24.22.2-dafa9c?labelColor=0f0f0f)](.nvmrc)
+[![Hacktoberfest 2026](https://img.shields.io/badge/Hacktoberfest%202026-Problem%2004-dafa9c?labelColor=0f0f0f)](HACKATHON.md)
+
+[**Try the website**](https://unmask-web-386156642190.asia-south1.run.app) ·
+[Analysis API](https://unmask-386156642190.asia-south1.run.app/version) ·
+[npm package](https://www.npmjs.com/package/@xagents_in/unmask) ·
+[Engineering docs](docs/README.md)
+
+</div>
+
+---
+
+## The problem in 30 seconds
+
+Developers review source code. Machines install the **published tarball**. Nothing
+forces the two to match: npm checks the tarball's hash, never its source.
+
+Attackers know this. Some of the worst supply-chain attacks hid their payload
+**only in the published package**:
+
+| Year | Package                 | What shipped that was never committed      |
+| ---- | ----------------------- | ------------------------------------------ |
+| 2018 | `flatmap-stream 0.1.1`  | A payload only in the minified npm file    |
+| 2018 | `eslint-scope 3.7.2`    | A `postinstall` that stole `.npmrc` tokens |
+| 2024 | `xz-utils 5.6.0`        | A backdoor only in the release tarballs    |
+| 2025 | `@ctrl/tinycolor 4.1.1` | A `bundle.js` added by the Shai-Hulud worm |
+
+Existing tools answer other questions. Vulnerability databases ask _"is this
+version known bad?"_. Behaviour scanners ask _"does it look malicious?"_. npm
+provenance asks _"where was it built?"_. **UNMASK asks: "what shipped that is not in
+the source, and where exactly?"**
+
+## Try it in one minute
+
+**On the web:** open the [website](https://unmask-web-386156642190.asia-south1.run.app),
+type an exact release such as `chalk@6.0.1`, and press **check it**.
+
+**From a terminal:**
+
+```bash
+npx @xagents_in/unmask check chalk@6.0.1 --out ./unmask-report
+```
+
+You get `report.json` and an escaped `report.html` in `./unmask-report`. Only the
+package name and version leave your machine; the hosted service does the rest.
+
+## What a check returns
+
+A real report for **`zod@4.6.7`**, from the live service:
+
+| What UNMASK found                        | Result                                           |
+| ---------------------------------------- | ------------------------------------------------ |
+| Published files compared with the source | **840**, against the commit the package claims   |
+| Byte-identical to the source             | **335**                                          |
+| In the package but not in the source     | **505**, mostly build output, each one listed    |
+| AI explanations                          | **3**, every quotation checked against the bytes |
+| Policy result                            | Exit `0`: no review rule fired. Never "safe"     |
+
+Alongside the report, `/r/<id>.details.json` gives a package profile: declared
+entry points, direct dependencies, install scripts, static capabilities,
+provenance, coverage, and the [OSV](https://osv.dev) advisories for that exact
+version. This view is merged on `main` but not yet on the live service.
 
-UNMASK compares an npm package's published bytes with a selected source archive.
-It produces a JSON report and an HTML evidence viewer: matching files, changed
-bytes, artifact-only files, uninspected content, and observations to review.
-A completed report is not a safety verdict.
+Every file lands in exactly one state, and every claim points to a byte range in a
+hashed file:
 
-Built for **Problem 04: Published Package vs Source Code Integrity Analyzer** at
-Hacktoberfest 2026, Hack Day Sonipat. See [HACKATHON.md](HACKATHON.md).
+| State            | Meaning                                                       |
+| ---------------- | ------------------------------------------------------------- |
+| `byte-identical` | Same size and SHA-256 as its source file                      |
+| `changed`        | A source twin exists, the bytes differ, and the span is shown |
+| `artifact-only`  | In the package, nowhere in the selected source                |
+| `not-compared`   | UNMASK could not judge, and says why. Nothing is hidden       |
 
-## Status
+## How it works
 
-The local candidate includes an npm CLI, a shared analyzer, a website with a
-bounded job queue, and an optional hosted Gemma adapter. It uses plain ESM
-JavaScript on Node.js 24.22.2. The npm package is `@xagents_in/unmask`.
-Release `0.1.0` was published and verified; the current source candidate is
-`0.1.1`, whose release and deployment acceptance are pending. The default service is
-`https://unmask-386156642190.asia-south1.run.app`. See the dated
-[deployment evidence](docs/README.md) for observed runtime versions and commits;
-source configuration does not establish acceptance of a new release.
+```mermaid
+flowchart TD
+  A["Exact release<br/>name@version"] --> B["Fetch the npm tarball<br/>and the claimed commit"]
+  B --> C["Unpack both as data<br/>nothing is run"]
+  C --> D["Compare every file<br/>byte for byte"]
+  D --> E["Read manifests<br/>and syntax cues"]
+  E --> F["Apply fixed rules<br/>exit 0 / 2 / 3"]
+  F --> G["Report: JSON and<br/>escaped HTML"]
+  F -. "only if something differs" .-> H["AI explains the evidence<br/>quotes checked"]
+  H -.-> G
+```
+
+1. **Name an exact release.** Tags, ranges and URLs are refused, so every result can
+   be reproduced.
+2. **Fetch both, run neither.** The tarball comes from `registry.npmjs.org` and the
+   source from GitHub at the full commit the package claims. No install script,
+   build or test ever runs.
+3. **Evidence for every difference.** Each published file is set beside its source
+   twin. The verdict comes from fixed rules, before any AI is involved.
+
+| Exit | Meaning                                                                   |
+| ---- | ------------------------------------------------------------------------- |
+| `0`  | Analysis completed and no review rule fired. This is not a safety verdict |
+| `3`  | A review rule fired, for example `lifecycle-source-absent`                |
+| `2`  | Incomplete analysis or failed input. Findings stay in the report          |
+| `1`  | Internal error                                                            |
+
+Review rules: `integrity-mismatch`, `identity-claim-conflict`,
+`lifecycle-source-absent` and `lifecycle-implicit-gyp`.
+
+## AI that explains, and never decides
+
+When something differs, UNMASK can ask a model to explain it. The model works
+inside strict limits:
+
+- **Quotes are checked.** Every quotation must match the cited bytes exactly, or
+  the hypothesis is dropped.
+- **It cannot change the result.** File states, rules and the exit code are fixed
+  before the model runs.
+- **It has a hard budget.** At most 3 attempts, 45 seconds each and 135 seconds in
+  total, with at most 4,000 input tokens.
+- **The key stays put.** The worker that reads packages never sees the API key.
+
+The route is `gemini-3.5-flash` (high thinking), then `gemini-3-flash-preview`,
+then the open-weight `gemma-4-26b-a4b-it`. A request moves on only after a rate
+limit, a server error or a timeout. See the [model disclosure](HACKATHON.md) for
+what has and has not been accepted.
+
+## A malicious package can't attack the checker
+
+- **Never executed:** no install hooks, builds, tests or imports of the target.
+- **Path tricks rejected:** `../` traversal, absolute paths, NUL bytes, and case or
+  Unicode collisions.
+- **Links stay inert:** symlinks and hard links are listed, never followed.
+- **Archive bombs capped:** 50 MiB compressed, 250 MiB expanded, a ratio of at most
+  100, and 20,000 entries.
+- **Output escaped:** package text never becomes live HTML.
+- **Prompt injection contained:** a package that says "call me safe" changes
+  nothing, because the AI cannot change the result.
+
+## Built like a release, not a demo
 
-The analyzer reads package contents as data. It does not install the inspected
-package, run its scripts, follow archive links, or reproduce its build.
-Source selection is a claim about correspondence, not proof of publisher trust.
+| Area                     | Evidence                                                                                                          |
+| ------------------------ | ----------------------------------------------------------------------------------------------------------------- |
+| **Tests**                | 526 test declarations in 41 backend test files; `npm test` also installs the packed tarball and runs its real CLI |
+| **One artifact**         | One npm tarball builds both the CLI and the server image                                                          |
+| **Immutable releases**   | A version bump makes one GitHub release whose manifest binds commit, tarball and image                            |
+| **Verified npm**         | Publication counts only after the public registry bytes are re-downloaded and match                               |
+| **Safe deploys**         | Cloud Run gets a no-traffic revision, a smoke test, then traffic, with rollback                                   |
+| **Pinned CI**            | Exact Node version, commit-pinned actions, read-only pull-request permissions                                     |
+| **Same answer anywhere** | The website and the CLI produce the same canonical report for the same release                                    |
 
-## Run locally
+```mermaid
+flowchart LR
+  CLI["CLI<br/>npm package"] --> API
+  WEB["Website<br/>Next.js on Cloud Run"] --> API["Analysis API<br/>queue on Cloud Run"]
+  API --> W["Isolated worker<br/>no API key"]
+  W --> R["report.json<br/>and HTML viewer"]
+  API -. "after the worker exits" .-> M["Model route"]
+```
+
+## Run it yourself
 
 Use Node.js 24.22.2, pinned in `.nvmrc`:
 
@@ -37,93 +177,87 @@ npm run check
 npm run check:package
 ```
 
-Check an exact public npm version through your configured UNMASK service:
+**Check a published release** through the hosted service:
 
 ```bash
 node dist/cli/main.mjs check chalk@6.0.1 --out /tmp/unmask-chalk-report
 ```
 
-Choose a fresh output directory for each check. The command writes `report.json`
-and `report.html` and refuses to replace existing report files. Public-package
-checks send only the exact package spec to the hosted service; the service owns
-acquisition and model policy. `UNMASK_SERVER_URL` overrides the default service.
-It must be an HTTPS origin, or a loopback HTTP origin for local testing. Hosted
-failure never falls back to local acquisition.
-See [CLI configuration and data flow](docs/cli.md).
+Choose a fresh output folder for each check; existing report files are never
+replaced. `UNMASK_SERVER_URL` selects another service: an HTTPS origin, or a
+loopback HTTP origin for local testing. A hosted failure never falls back to local
+acquisition. See [CLI configuration and data flow](docs/cli.md).
 
-To analyze local archives without network acquisition:
+**Check a local tarball offline**, for example a copy you suspect was tampered with:
 
 ```bash
 node dist/cli/main.mjs check --offline --tarball /path/to/package.tgz --source-archive /path/to/source.tar.gz --commit FULL_40_CHARACTER_LOWERCASE_COMMIT_SHA --source-root ARCHIVE_TOP_LEVEL_DIRECTORY --source-dir '' --cache-dir /tmp/unmask-local-cache --out /tmp/unmask-local-report
 ```
 
-`--source-dir ''` explicitly selects the repository root. For a monorepo, supply
-the package's directory relative to that root. Omit all source options for an
-artifact-only report. An optional `--claim name@version` checks an explicit
-identity claim against the artifact manifest.
-
-Exit codes: `0` means analysis completed; `2` means analysis was incomplete or
-input acquisition failed; `3` means a default review-policy finding; `1` means an
-internal error. Findings remain visible when incomplete analysis takes priority.
-Exit `0` never means a package is safe.
+`--source-dir ''` selects the repository root; for a monorepo, give the package's
+folder instead. Leave out all source options for an artifact-only report.
+`--claim name@version` checks an identity claim against the package manifest.
+Excerpts leave the machine only if you add `--allow-model` and configure a provider.
 
-Start the website locally:
+**Run the website locally:**
 
 ```bash
 UNMASK_MODEL=off HOST=127.0.0.1 PORT=3000 node dist/server/main.mjs
 ```
 
-Visit `http://127.0.0.1:3000`. The website accepts exact public npm versions,
-queues analysis, and serves the same report format as the CLI. It accepts no
-uploads. Its development worker limits and temporary-file cleanup do not
-constitute an operating-system security sandbox.
-
-The Next.js frontend in [`web/`](web/README.md) can sit in front of that server.
-Start it with `UNMASK_API_URL=http://127.0.0.1:3000`; see its README.
-
-## Inspection limits
-
-- File correspondence uses hashes and bounded byte comparisons. Transpilation,
-  minification, sourcemaps and declared output locations do not prove equivalence.
-- Syntax cues use a bounded JavaScript parser. TypeScript, JSX, unsupported syntax,
-  dynamic behavior and unretained content remain uninspected.
-- Literal novelty means only "not found in inspected source". Missing or
-  insufficient source cannot establish full-source absence.
-- Ambiguous source-package selection is incomplete. For example, multiple
-  same-name manifests in Axios source require an explicit local source directory;
-  the website currently has no such override.
-- This candidate covers npm only. PyPI and continuous release monitoring are
-  not implemented.
-
-## Models and releases
-
-Model output is advisory and cannot change deterministic policy findings. The
-adapter has recorded-transport tests, but real endpoint availability, account
-quotas and usefulness still require validation. Hosted CLI checks follow the
-service's published model/data disclosure and never read a local provider key.
-Only offline local checks use `--allow-model`; without that flag no local model
-client is constructed. The flag alone does not configure an offline provider.
-See [HACKATHON.md](HACKATHON.md) for the exact candidate and remaining AI gate.
-
-`npm test` runs product and release-tooling tests, including a packed tarball
-installed into a temporary directory and invoked through its real CLI binary.
-`npm run check` checks formatting; it is not static type checking. Product tests
-and local HTTP checks do not establish deployment readiness.
-
-Release publication is enabled for the `0.1.1` source candidate, subject to CI
-and runtime release gates. A completed immutable release with verified npm
-publication triggers API deployment in the same workflow. Successful API
-verification then triggers website deployment for that exact release commit.
-See [release prerequisites](docs/releases.md). npm access is not required for
-local builds or testing.
+Then visit `http://127.0.0.1:3000`. The Next.js frontend in [`web/`](web/README.md)
+can sit in front of it with `UNMASK_API_URL=http://127.0.0.1:3000`.
+
+## What UNMASK does not claim
+
+Being clear about limits is part of the product.
+
+- **Matching code can still be malicious.** If the bad code is in the source too,
+  a comparison cannot catch it.
+- **Build output is noisy.** Bundled and transpiled files have no source twin;
+  sourcemaps and declared output locations do not prove equivalence.
+- **Syntax cues are bounded.** TypeScript, JSX, unsupported syntax and dynamic
+  behaviour stay uninspected. "Novel" means only "not found in the inspected
+  source".
+- **Ambiguous sources stay incomplete.** If a repository has two manifests with the
+  package's name (axios does), the CLI needs `--source-dir`; the website has no
+  override yet.
+- **The AI is advisory.** A checked quotation proves where the model looked, not
+  that its reasoning is right. Open-weight acceptance of the Gemma tier is still
+  pending.
+- **npm only, for now.** PyPI and continuous release monitoring are not
+  implemented.
+
+## Read more
+
+| Page                                                 | What it covers                                            |
+| ---------------------------------------------------- | --------------------------------------------------------- |
+| [HACKATHON.md](HACKATHON.md)                         | Team, problem statement and the exact AI model disclosure |
+| [Engineering docs](docs/README.md)                   | Live services, model evidence and the documentation map   |
+| [Architecture](docs/architecture.md)                 | Flows, process boundaries and job states                  |
+| [Contracts](docs/contracts.md)                       | Inputs, report shape, exit policy and HTTP behaviour      |
+| [CLI](docs/cli.md)                                   | Hosted and offline CLI configuration and data flow        |
+| [Releases](docs/releases.md)                         | Release gates and artifact verification                   |
+| [Cloud Run deployment](docs/cloud-run-deployment.md) | How a release reaches production                          |
+| [Website](web/README.md)                             | The Next.js site and its connection to the analyzer       |
+
+## Team Cappybara
+
+Built in one night at **Hacktoberfest 2026, Hack Day Sonipat**, for
+**Problem 04: Published Package vs Source Code Integrity Analyzer**.
+
+| Member             | Focus                                          |
+| ------------------ | ---------------------------------------------- |
+| Pranay Vishwakarma | Team lead, website                             |
+| Vaiditya Tanwar    | Analyzer, AI route, CI, release and deployment |
+| Vishesh Rao        | CLI and npm release                            |
+| Sayan Bhattacharya | Project report, QA and documentation           |
 
 ## Contributing
 
 See [CONTRIBUTING.md](CONTRIBUTING.md) for review, test and comment conventions.
-Every remote change after the initial event commit goes through a PR. Repository
-permissions and code-owner enforcement must be verified on GitHub; the
-CODEOWNERS file alone does not enforce them.
+Every change after the initial event commit goes through a pull request.
 
 ## License
 
-[MIT](LICENSE).
+[MIT](LICENSE)

package/dist/cli/batch.mjs

@@ -0,0 +1,218 @@
+import { parsePackageSpec } from "../core/acquire.mjs";
+import { LocalInputError } from "../core/pipeline.mjs";
+import { checkHosted } from "./hosted.mjs";
+
+const failure = (code, message) => new LocalInputError(code, message);
+const MAX_ITEMS = 25;
+const MAX_INPUT_BYTES = 16384;
+const terminalValue = (value) =>
+  JSON.stringify(value).replace(
+    /[\u007f-\u009f\u2028\u2029]/gu,
+    (character) =>
+      `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`,
+  );
+
+async function readInput(stdin, signal) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 5000);
+  const lifetime = signal
+    ? AbortSignal.any([signal, controller.signal])
+    : controller.signal;
+  let onAbort;
+  try {
+    const aborted = new Promise((_resolve, reject) => {
+      onAbort = () =>
+        reject(
+          failure(
+            "batch-input-cancelled",
+            "Batch stdin timed out or was cancelled before EOF.",
+          ),
+        );
+      lifetime.addEventListener("abort", onAbort, { once: true });
+      if (lifetime.aborted) onAbort();
+    });
+    const reading = (async () => {
+      const chunks = [];
+      let size = 0;
+      for await (const chunk of stdin) {
+        const bytes = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+        if (!(bytes instanceof Uint8Array))
+          throw failure("batch-input", "Batch stdin must contain UTF-8 text.");
+        size += bytes.byteLength;
+        if (size > MAX_INPUT_BYTES)
+          throw failure("batch-input-limit", "Batch stdin exceeds 16 KiB.");
+        chunks.push(bytes);
+      }
+      try {
+        return new TextDecoder("utf-8", { fatal: true }).decode(
+          Buffer.concat(chunks, size),
+        );
+      } catch {
+        throw failure(
+          "batch-input",
+          "Batch stdin must contain valid UTF-8 text.",
+        );
+      }
+    })();
+    return await Promise.race([reading, aborted]);
+  } catch (error) {
+    if (error instanceof LocalInputError) throw error;
+    throw failure("batch-input", "Batch stdin could not be read.");
+  } finally {
+    clearTimeout(timer);
+    lifetime.removeEventListener("abort", onAbort);
+    if (lifetime.aborted) stdin.destroy?.();
+  }
+}
+
+async function inputs(argv, runtime) {
+  const specs = [];
+  const seen = new Set();
+  for (const arg of argv) {
+    if (arg.startsWith("--")) {
+      if (!["--stdin", "--json"].includes(arg) || seen.has(arg))
+        throw failure(
+          "usage",
+          "Use batch exact-spec... [--stdin] [--json], with each option once.",
+        );
+      seen.add(arg);
+    } else specs.push(arg);
+  }
+  if (specs.length > MAX_ITEMS || specs.some((spec) => spec.length > 512))
+    throw failure(
+      "batch-input-limit",
+      "Batch accepts at most 25 inputs of at most 512 characters each.",
+    );
+  if (seen.has("--stdin")) {
+    const text = await readInput(
+      runtime.stdin ?? process.stdin,
+      runtime.signal,
+    );
+    specs.push(...text.split(/\s+/u).filter(Boolean));
+  }
+  if (!specs.length)
+    throw failure(
+      "usage",
+      "Batch requires explicit exact specs from args or --stdin.",
+    );
+  if (specs.length > MAX_ITEMS || specs.some((spec) => spec.length > 512))
+    throw failure(
+      "batch-input-limit",
+      "Batch accepts at most 25 inputs of at most 512 characters each.",
+    );
+  return { specs, json: seen.has("--json") };
+}
+
+export async function runBatch(argv, runtime = {}) {
+  const { specs, json } = await inputs(argv, runtime);
+  const unique = new Map();
+  for (const [index, spec] of specs.entries()) {
+    if (!unique.has(spec)) unique.set(spec, { spec, inputIndexes: [] });
+    unique.get(spec).inputIndexes.push(index);
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 600000);
+  const lifetime = runtime.signal
+    ? AbortSignal.any([runtime.signal, controller.signal])
+    : controller.signal;
+  const items = [];
+  let paused = false;
+  try {
+    for (const item of unique.values()) {
+      const result = { ...item, occurrences: item.inputIndexes.length };
+      try {
+        parsePackageSpec(item.spec);
+      } catch {
+        items.push({
+          ...result,
+          status: "error",
+          error: {
+            code: "invalid-package-spec",
+            message:
+              "Use an exact public npm package name@version; ranges, tags and URLs are unsupported.",
+          },
+        });
+        continue;
+      }
+      if (lifetime.aborted || paused) {
+        items.push({
+          ...result,
+          status: "not-checked",
+          error: {
+            code: lifetime.aborted
+              ? "batch-cancelled"
+              : "batch-submission-paused",
+            message: "No hosted request was submitted for this item.",
+          },
+        });
+        continue;
+      }
+      try {
+        const report = await checkHosted(item.spec, {
+          serverUrl: (runtime.env ?? process.env).UNMASK_SERVER_URL,
+          fetchImpl: runtime.fetchImpl,
+          signal: lifetime,
+          limits: runtime.hostedLimits,
+        });
+        items.push({
+          ...result,
+          status: "completed",
+          policyExitCode: report.policy.exitCode,
+          findingCount: report.policy.findings.length,
+          model: {
+            status: String(report.model?.status ?? "unavailable").slice(0, 80),
+          },
+        });
+      } catch (error) {
+        const known = error instanceof LocalInputError;
+        items.push({
+          ...result,
+          status: "error",
+          error: {
+            code: known ? error.code : "batch-check-failed",
+            message: known
+              ? error.message
+              : "Check failed; no completed result is claimed.",
+          },
+        });
+        if (
+          ["hosted-submit-failed", "hosted-report-failed"].includes(error?.code)
+        )
+          paused = true;
+      }
+    }
+  } finally {
+    clearTimeout(timer);
+  }
+  const result = {
+    schemaVersion: "1",
+    requestedCount: specs.length,
+    uniqueCount: items.length,
+    duplicateCount: specs.length - items.length,
+    completedCount: items.filter((item) => item.status === "completed").length,
+    errorCount: items.filter((item) => item.status === "error").length,
+    notCheckedCount: items.filter((item) => item.status === "not-checked")
+      .length,
+    items,
+  };
+  const exitCode =
+    result.errorCount || result.notCheckedCount
+      ? 2
+      : items.some((item) => item.policyExitCode === 3)
+        ? 3
+        : items.some((item) => item.policyExitCode === 2)
+          ? 2
+          : 0;
+  const stdout = runtime.stdout ?? process.stdout;
+  if (json) stdout.write(JSON.stringify({ ...result, exitCode }) + "\n");
+  else {
+    for (const item of items)
+      stdout.write(
+        `${terminalValue(item.spec)} x${item.occurrences}: ${item.status}${item.status === "completed" ? `; policy exit ${item.policyExitCode}; findings ${item.findingCount}; AI status ${terminalValue(item.model.status)}` : `; ${item.error.code}`}\n`,
+      );
+    stdout.write(
+      `Batch: ${result.completedCount} completed, ${result.errorCount} errors, ${result.notCheckedCount} not checked; ${result.duplicateCount} duplicate inputs coalesced.\nNo findings do not establish safety.\n`,
+    );
+  }
+  return exitCode;
+}

package/dist/cli/main.mjs

@@ -9,6 +9,8 @@ import { parsePackageSpec, AcquisitionError } from "../core/acquire.mjs";
 import { addConfiguredModel } from "../core/online.mjs";
 import { modelClientFromEnv } from "../model/config.mjs";
 import { checkHosted } from "./hosted.mjs";
+import { runScan } from "./scan.mjs";
+import { runBatch } from "./batch.mjs";
 
 const names = {
   "--tarball": "tarballPath",
@@ -162,6 +164,8 @@ async function configuredModel(allowModel, runtime) {
 
 export async function main(argv = process.argv.slice(2), runtime = {}) {
   try {
+    if (argv[0] === "scan") return await runScan(argv.slice(1), runtime);
+    if (argv[0] === "batch") return await runBatch(argv.slice(1), runtime);
     const { out, offline, allowModel, registrySpec, ...options } = parse(argv);
     let report;
     if (registrySpec)