agentaudit 3.9.20 → 3.9.22

package/cli.mjs

@@ -58,6 +58,7 @@ function resolveProvider(flagOverride, keys) {
 // ── Global flags (set in main before command routing) ────
 let jsonMode = false;
 let quietMode = false;
+let modelOverride = null; // --model flag or AGENTAUDIT_MODEL env or config
 
 // ── ANSI Colors (respects NO_COLOR and --no-color) ───────
 
@@ -1486,7 +1487,7 @@ async function auditRepo(url) {
           'content-type': 'application/json',
         },
         body: JSON.stringify({
-          model: 'claude-sonnet-4-20250514',
+          model: modelOverride || 'claude-sonnet-4-20250514',
           max_tokens: 8192,
           system: systemPrompt,
           messages: [{ role: 'user', content: userMessage }],
@@ -1509,22 +1510,22 @@ async function auditRepo(url) {
       switch (resolvedProvider.id) {
         case 'openrouter':
           apiUrl = 'https://openrouter.ai/api/v1/chat/completions';
-          modelName = process.env.OPENROUTER_MODEL || 'anthropic/claude-sonnet-4';
+          modelName = modelOverride || process.env.OPENROUTER_MODEL || 'anthropic/claude-sonnet-4';
           authHeaders = { 'Authorization': `Bearer ${resolvedProvider.key}`, 'HTTP-Referer': 'https://agentaudit.dev', 'X-Title': 'AgentAudit' };
           break;
         case 'ollama':
           apiUrl = `${resolvedProvider.host}/v1/chat/completions`;
-          modelName = resolvedProvider.model;
+          modelName = modelOverride || resolvedProvider.model;
           authHeaders = {};
           break;
         case 'custom':
           apiUrl = resolvedProvider.url.endsWith('/chat/completions') ? resolvedProvider.url : `${resolvedProvider.url.replace(/\/$/, '')}/chat/completions`;
-          modelName = resolvedProvider.model;
+          modelName = modelOverride || resolvedProvider.model;
           authHeaders = resolvedProvider.key ? { 'Authorization': `Bearer ${resolvedProvider.key}` } : {};
           break;
         default: // openai
           apiUrl = 'https://api.openai.com/v1/chat/completions';
-          modelName = 'gpt-4o';
+          modelName = modelOverride || 'gpt-4o';
           authHeaders = { 'Authorization': `Bearer ${resolvedProvider.key}` };
       }
 
@@ -1630,7 +1631,7 @@ async function auditRepo(url) {
 
 // ── Check command ───────────────────────────────────────
 
-async function checkPackage(name) {
+async function checkPackage(name, { autoAudit = false } = {}) {
   if (!jsonMode) {
     console.log(`${icons.info}  Looking up ${c.bold}${name}${c.reset} in registry...`);
     console.log();
@@ -1639,8 +1640,8 @@ async function checkPackage(name) {
   const data = await checkRegistry(name);
   if (!data) {
     if (!jsonMode) {
-      // If input looks like a URL, offer to auto-audit
-      if (name.includes('github.com') || name.includes('://')) {
+      // Auto-audit: only when called from 'check' command AND input looks like a URL
+      if (autoAudit && (name.includes('github.com') || name.includes('://'))) {
         console.log(`  ${c.yellow}Not found in registry.${c.reset}`);
         console.log(`  ${c.dim}Starting audit for ${name}...${c.reset}`);
         console.log();
@@ -1649,7 +1650,8 @@ async function checkPackage(name) {
       console.log(`  ${c.yellow}✖  Not found${c.reset} — "${name}" hasn't been audited yet.`);
       console.log();
       console.log(`  ${c.dim}Next steps:${c.reset}`);
-      console.log(`    ${c.cyan}agentaudit audit <repo-url>${c.reset}    ${c.dim}Run a deep audit yourself${c.reset}`);
+      console.log(`    ${c.cyan}agentaudit check <repo-url>${c.reset}    ${c.dim}Auto-lookup + audit if not found${c.reset}`);
+      console.log(`    ${c.cyan}agentaudit audit <repo-url>${c.reset}    ${c.dim}Deep LLM audit${c.reset}`);
       console.log(`    ${c.cyan}agentaudit scan <repo-url>${c.reset}     ${c.dim}Quick static check (no API key)${c.reset}`);
     }
     return null;
@@ -1731,9 +1733,25 @@ async function main() {
   quietMode = rawArgs.includes('--quiet') || rawArgs.includes('-q');
   // --no-color already handled at top level for `c` object
   
+  // --model flag: --model=<name> or --model <name>
+  const modelFlagIdx = rawArgs.findIndex(a => a === '--model');
+  const modelFlagEq = rawArgs.find(a => a.startsWith('--model='));
+  modelOverride = modelFlagEq?.split('=')[1]
+    || (modelFlagIdx >= 0 ? rawArgs[modelFlagIdx + 1] : null)
+    || process.env.AGENTAUDIT_MODEL
+    || loadConfig()?.preferred_model
+    || null;
+  
   // Strip global flags from args
   const globalFlags = new Set(['--json', '--quiet', '-q', '--no-color']);
-  const args = rawArgs.filter(a => !globalFlags.has(a));
+  let args = rawArgs.filter(a => !globalFlags.has(a));
+  // Strip --model and its value
+  args = args.filter((a, i, arr) => {
+    if (a.startsWith('--model=')) return false;
+    if (a === '--model') { arr[i + 1] = '__skip__'; return false; }
+    if (a === '__skip__') return false;
+    return true;
+  });
   
   if (args[0] === '-v' || args[0] === '--version') {
     console.log(`agentaudit ${getVersion()}`);
@@ -1757,6 +1775,7 @@ async function main() {
     console.log(`  ${c.bold}SETUP${c.reset}`);
     console.log(`    ${c.cyan}status${c.reset}                       Check providers & API keys`);
     console.log(`    ${c.cyan}setup${c.reset}                        Register & configure`);
+    console.log(`    ${c.cyan}models${c.reset}                       List available LLM models`);
     console.log(`    ${c.cyan}config set${c.reset} <key> <value>     Set default provider/options`);
     console.log();
     console.log(`  ${c.bold}OPTIONS${c.reset}`);
@@ -1764,6 +1783,7 @@ async function main() {
     console.log(`    ${c.dim}--quiet        Suppress banner${c.reset}`);
     console.log(`    ${c.dim}--no-color     Disable colors ${c.reset}${c.dim}(also: NO_COLOR=1)${c.reset}`);
     console.log(`    ${c.dim}--provider <p> Force provider ${c.reset}${c.dim}(anthropic|openai|openrouter|ollama|custom)${c.reset}`);
+    console.log(`    ${c.dim}--model <m>    Override model ${c.reset}${c.dim}(e.g. gpt-4o-mini, claude-3.5-sonnet)${c.reset}`);
     console.log(`    ${c.dim}--export       Export audit payload to markdown${c.reset}`);
     console.log(`    ${c.dim}--debug        Show raw LLM response on errors${c.reset}`);
     console.log();
@@ -1775,7 +1795,9 @@ async function main() {
     console.log();
     console.log(`  ${c.bold}PROVIDERS${c.reset} ${c.dim}(set any one for deep audits)${c.reset}`);
     console.log(`    ${c.dim}ANTHROPIC_API_KEY · OPENAI_API_KEY · OPENROUTER_API_KEY · OLLAMA_MODEL · LLM_API_URL${c.reset}`);
-    console.log(`    ${c.dim}Set default: AGENTAUDIT_PROVIDER=openai or agentaudit config set provider openai${c.reset}`);
+    console.log(`    ${c.dim}Set default: AGENTAUDIT_PROVIDER=openai  AGENTAUDIT_MODEL=gpt-4o-mini${c.reset}`);
+    console.log(`    ${c.dim}Or persist: agentaudit config set provider openai${c.reset}`);
+    console.log(`    ${c.dim}            agentaudit config set model gpt-4o-mini${c.reset}`);
     console.log(`    ${c.dim}Run ${c.cyan}agentaudit status${c.dim} to check configuration.${c.reset}`);
     console.log();
     process.exitCode = 0; return;
@@ -1858,9 +1880,11 @@ async function main() {
     const resolved = resolveProvider(null, keys);
     console.log();
     if (resolved) {
-      console.log(`    ${c.bold}Active:${c.reset} ${c.green}${resolved.label}${c.reset}`);
-      console.log(`    ${c.dim}Override: --provider=<name> or AGENTAUDIT_PROVIDER=<name>${c.reset}`);
+      const activeModel = modelOverride || process.env.AGENTAUDIT_MODEL || loadConfig()?.preferred_model;
+      console.log(`    ${c.bold}Active:${c.reset} ${c.green}${resolved.label}${c.reset}${activeModel ? `  ${c.dim}model: ${activeModel}${c.reset}` : ''}`);
+      console.log(`    ${c.dim}Override: --provider=<name> --model=<name>${c.reset}`);
       console.log(`    ${c.dim}Set default: agentaudit config set provider <name>${c.reset}`);
+      console.log(`    ${c.dim}             agentaudit config set model <name>${c.reset}`);
     } else {
       console.log(`    ${c.yellow}⚠  No working LLM provider.${c.reset} Deep audits require one.`);
       console.log(`    ${c.dim}Set a key: export ANTHROPIC_API_KEY=sk-ant-...${c.reset}`);
@@ -1888,6 +1912,113 @@ async function main() {
     return;
   }
   
+  if (command === 'models') {
+    const anthropicKey = process.env.ANTHROPIC_API_KEY;
+    const openaiKey = process.env.OPENAI_API_KEY;
+    const openrouterKey = process.env.OPENROUTER_API_KEY;
+    
+    console.log(`  ${c.bold}Available models by provider:${c.reset}`);
+    console.log();
+    
+    // Static lists for Anthropic (no list API)
+    console.log(`  ${c.bold}Anthropic${c.reset}${anthropicKey ? ` ${c.green}(configured)${c.reset}` : ` ${c.dim}(not configured)${c.reset}`}`);
+    console.log(`    ${c.dim}claude-sonnet-4-20250514${c.reset}      ${c.dim}(default)${c.reset}`);
+    console.log(`    ${c.dim}claude-opus-4-20250514${c.reset}`);
+    console.log(`    ${c.dim}claude-haiku-3-20250514${c.reset}`);
+    console.log();
+    
+    // Static list for OpenAI
+    console.log(`  ${c.bold}OpenAI${c.reset}${openaiKey ? ` ${c.green}(configured)${c.reset}` : ` ${c.dim}(not configured)${c.reset}`}`);
+    console.log(`    ${c.dim}gpt-4o${c.reset}                        ${c.dim}(default)${c.reset}`);
+    console.log(`    ${c.dim}gpt-4o-mini${c.reset}`);
+    console.log(`    ${c.dim}gpt-4.1${c.reset}`);
+    console.log(`    ${c.dim}gpt-4.1-mini${c.reset}`);
+    console.log(`    ${c.dim}o3${c.reset}`);
+    console.log(`    ${c.dim}o4-mini${c.reset}`);
+    console.log();
+    
+    // OpenRouter — fetch from API
+    console.log(`  ${c.bold}OpenRouter${c.reset}${openrouterKey ? ` ${c.green}(configured)${c.reset}` : ` ${c.dim}(not configured)${c.reset}`}`);
+    if (openrouterKey || targets.includes('--all')) {
+      process.stdout.write(`    ${c.dim}Fetching models...${c.reset}`);
+      try {
+        const res = await fetch('https://openrouter.ai/api/v1/models', {
+          headers: openrouterKey ? { 'Authorization': `Bearer ${openrouterKey}` } : {},
+          signal: AbortSignal.timeout(10_000),
+        });
+        const data = await res.json();
+        const models = (data.data || [])
+          .filter(m => m.id && !m.id.includes(':free') && !m.id.includes('/extended'))
+          .sort((a, b) => (a.id || '').localeCompare(b.id || ''));
+        
+        // Group by provider prefix
+        const groups = {};
+        for (const m of models) {
+          const [prefix] = m.id.split('/');
+          if (!groups[prefix]) groups[prefix] = [];
+          groups[prefix].push(m);
+        }
+        
+        // Show popular ones first
+        const popular = ['anthropic', 'openai', 'google', 'meta-llama', 'mistralai', 'deepseek'];
+        const shown = new Set();
+        process.stdout.write(`\r    ${c.green}${models.length} models available${c.reset}                    \n`);
+        console.log();
+        
+        for (const prefix of popular) {
+          if (!groups[prefix]) continue;
+          shown.add(prefix);
+          console.log(`    ${c.bold}${prefix}${c.reset}`);
+          for (const m of groups[prefix].slice(0, 5)) {
+            console.log(`      ${c.dim}${m.id}${c.reset}`);
+          }
+          if (groups[prefix].length > 5) {
+            console.log(`      ${c.dim}... and ${groups[prefix].length - 5} more${c.reset}`);
+          }
+        }
+        
+        const otherCount = Object.keys(groups).filter(k => !shown.has(k)).length;
+        if (otherCount > 0) {
+          console.log();
+          console.log(`    ${c.dim}+ ${otherCount} more providers. Use --model=<provider/model>${c.reset}`);
+          console.log(`    ${c.dim}Full list: https://openrouter.ai/models${c.reset}`);
+        }
+      } catch (e) {
+        process.stdout.write(`\r    ${c.red}Failed to fetch: ${e.message}${c.reset}                    \n`);
+      }
+    } else {
+      console.log(`    ${c.dim}anthropic/claude-sonnet-4${c.reset}    ${c.dim}(default)${c.reset}`);
+      console.log(`    ${c.dim}Set OPENROUTER_API_KEY to see all ${c.bold}200+${c.reset}${c.dim} models${c.reset}`);
+      console.log(`    ${c.dim}Or browse: https://openrouter.ai/models${c.reset}`);
+    }
+    console.log();
+    
+    // Ollama
+    const ollamaModel = process.env.OLLAMA_MODEL;
+    const ollamaHost = process.env.OLLAMA_HOST || 'http://localhost:11434';
+    console.log(`  ${c.bold}Ollama${c.reset}${ollamaModel ? ` ${c.green}(configured: ${ollamaModel})${c.reset}` : ` ${c.dim}(not configured)${c.reset}`}`);
+    if (ollamaModel || process.env.OLLAMA_HOST) {
+      try {
+        const res = await fetch(`${ollamaHost}/api/tags`, { signal: AbortSignal.timeout(5_000) });
+        const data = await res.json();
+        for (const m of (data.models || []).slice(0, 10)) {
+          console.log(`    ${c.dim}${m.name}${c.reset}`);
+        }
+      } catch {
+        console.log(`    ${c.dim}(Ollama not running at ${ollamaHost})${c.reset}`);
+      }
+    } else {
+      console.log(`    ${c.dim}Set OLLAMA_MODEL to use local models${c.reset}`);
+    }
+    console.log();
+    
+    console.log(`  ${c.bold}Set model:${c.reset}`);
+    console.log(`    ${c.cyan}agentaudit config set model <name>${c.reset}`);
+    console.log(`    ${c.cyan}agentaudit audit <url> --model <name>${c.reset}`);
+    console.log(`    ${c.dim}Or env: AGENTAUDIT_MODEL=<name>${c.reset}`);
+    return;
+  }
+  
   if (command === 'config') {
     const subCmd = targets[0];
     if (subCmd === 'set' && targets[1] === 'provider' && targets[2]) {
@@ -1902,6 +2033,12 @@ async function main() {
       console.log(`  ${c.green}✔${c.reset}  Default provider set to: ${c.bold}${val}${c.reset}`);
       console.log(`     ${c.dim}Override per-command: --provider=<name>${c.reset}`);
       console.log(`     ${c.dim}Or env: AGENTAUDIT_PROVIDER=<name>${c.reset}`);
+    } else if (subCmd === 'set' && targets[1] === 'model' && targets[2]) {
+      const val = targets[2];
+      saveConfig({ preferred_model: val });
+      console.log(`  ${c.green}✔${c.reset}  Default model set to: ${c.bold}${val}${c.reset}`);
+      console.log(`     ${c.dim}Override per-command: --model=<name>${c.reset}`);
+      console.log(`     ${c.dim}Or env: AGENTAUDIT_MODEL=<name>${c.reset}`);
     } else if (subCmd === 'get' || !subCmd) {
       const cfg = loadConfig();
       console.log(`  ${c.bold}Config:${c.reset} ${USER_CONFIG_FILE}`);
@@ -1933,8 +2070,9 @@ async function main() {
       return;
     }
     const results = [];
+    const allowAutoAudit = command === 'check'; // only 'check' auto-audits, 'lookup' never does
     for (const t of names) {
-      const data = await checkPackage(t);
+      const data = await checkPackage(t, { autoAudit: allowAutoAudit });
       results.push(data);
     }
     if (jsonMode) {
@@ -2005,7 +2143,7 @@ async function main() {
   }
   
   // Typo correction via Levenshtein distance
-  const knownCommands = ['discover', 'scan', 'audit', 'check', 'lookup', 'status', 'setup', 'config'];
+  const knownCommands = ['discover', 'scan', 'audit', 'check', 'lookup', 'status', 'setup', 'config', 'models'];
   const suggestion = knownCommands
     .map(cmd => ({ cmd, dist: levenshtein(command, cmd) }))
     .filter(x => x.dist <= 3)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentaudit",
-  "version": "3.9.20",
+  "version": "3.9.22",
   "description": "Security scanner for AI packages — MCP server + CLI",
   "type": "module",
   "bin": {