agentaudit 3.9.21 → 3.9.23

package/cli.mjs

@@ -39,7 +39,7 @@ function resolveProvider(flagOverride, keys) {
   // Aliases
   const aliases = { claude: 'anthropic', gpt: 'openai', 'gpt-4o': 'openai', 'gpt4': 'openai', or: 'openrouter', local: 'ollama' };
 
-  // Priority: --provider flag > AGENTAUDIT_PROVIDER env > config file > auto-detect
+  // Priority: --provider flag > AGENTAUDIT_PROVIDER env > config file > model-inferred > auto-detect
   const preferred = flagOverride
     || process.env.AGENTAUDIT_PROVIDER?.toLowerCase()
     || loadConfig()?.preferred_provider
@@ -51,6 +51,14 @@ function resolveProvider(flagOverride, keys) {
     if (!p) return null;
     return p;
   }
+  
+  // Smart inference: if model override looks like "provider/model" (e.g. z-ai/glm-5, anthropic/claude-sonnet-4)
+  // → auto-select OpenRouter (which uses that format)
+  const activeModel = globalModelOverride || process.env.AGENTAUDIT_MODEL || loadConfig()?.preferred_model;
+  if (activeModel && activeModel.includes('/') && providers.openrouter) {
+    return providers.openrouter;
+  }
+  
   // Auto-detect priority: Anthropic > OpenAI > OpenRouter > Custom > Ollama (local last — usually weaker)
   return providers.anthropic || providers.openai || providers.openrouter || providers.custom || providers.ollama || null;
 }
@@ -59,6 +67,7 @@ function resolveProvider(flagOverride, keys) {
 let jsonMode = false;
 let quietMode = false;
 let modelOverride = null; // --model flag or AGENTAUDIT_MODEL env or config
+let globalModelOverride = null; // same, but set early for resolveProvider
 
 // ── ANSI Colors (respects NO_COLOR and --no-color) ───────
 
@@ -1457,8 +1466,22 @@ async function auditRepo(url) {
     return null;
   }
   
+  // Determine actual model name for display
+  let actualModel;
+  if (resolvedProvider.id === 'anthropic') {
+    actualModel = modelOverride || 'claude-sonnet-4-20250514';
+  } else if (resolvedProvider.id === 'openrouter') {
+    actualModel = modelOverride || process.env.OPENROUTER_MODEL || 'anthropic/claude-sonnet-4';
+  } else if (resolvedProvider.id === 'openai') {
+    actualModel = modelOverride || 'gpt-4o';
+  } else if (resolvedProvider.id === 'ollama') {
+    actualModel = modelOverride || resolvedProvider.model;
+  } else {
+    actualModel = modelOverride || resolvedProvider.model || 'unknown';
+  }
+  
   // We have an API key — run LLM audit
-  process.stdout.write(`  ${c.dim}[4/4]${c.reset} Running LLM analysis ${c.dim}(${activeProvider})${c.reset}...`);
+  process.stdout.write(`  ${c.dim}[4/4]${c.reset} Running LLM analysis ${c.dim}(${resolvedProvider.id}: ${actualModel})${c.reset}...`);
   
   const systemPrompt = auditPrompt || 'You are a security auditor. Analyze the code and report findings as JSON.';
   const userMessage = [
@@ -1579,7 +1602,11 @@ async function auditRepo(url) {
   // Display results
   console.log();
   const riskScore = report.risk_score || 0;
-  console.log(`  ${riskBadge(riskScore)} Risk ${riskScore}/100  ${c.bold}${report.result || 'unknown'}${c.reset}`);
+  const trustScore = 100 - riskScore;
+  const trustColor = trustScore >= 70 ? c.green : trustScore >= 40 ? c.yellow : c.red;
+  const trustLabel = trustScore >= 70 ? 'SAFE' : trustScore >= 40 ? 'CAUTION' : 'UNSAFE';
+  console.log(`  ${trustColor}${c.bold}${trustLabel}${c.reset}  ${trustColor}Trust Score: ${trustScore}/100${c.reset}  ${c.dim}(Risk: ${riskScore}/100)${c.reset}`);
+  console.log(`  ${c.dim}Model: ${resolvedProvider.id}/${actualModel}  Duration: ${elapsed(start)}${c.reset}`);
   console.log();
   
   if (report.findings && report.findings.length > 0) {
@@ -1608,7 +1635,7 @@ async function auditRepo(url) {
           'Authorization': `Bearer ${creds.api_key}`,
           'Content-Type': 'application/json',
         },
-        body: JSON.stringify(report),
+        body: JSON.stringify({ ...report, audit_model: actualModel, audit_provider: resolvedProvider.id }),
         signal: AbortSignal.timeout(15_000),
       });
       if (res.ok) {
@@ -1631,7 +1658,7 @@ async function auditRepo(url) {
 
 // ── Check command ───────────────────────────────────────
 
-async function checkPackage(name) {
+async function checkPackage(name, { autoAudit = false } = {}) {
   if (!jsonMode) {
     console.log(`${icons.info}  Looking up ${c.bold}${name}${c.reset} in registry...`);
     console.log();
@@ -1640,8 +1667,8 @@ async function checkPackage(name) {
   const data = await checkRegistry(name);
   if (!data) {
     if (!jsonMode) {
-      // If input looks like a URL, offer to auto-audit
-      if (name.includes('github.com') || name.includes('://')) {
+      // Auto-audit: only when called from 'check' command AND input looks like a URL
+      if (autoAudit && (name.includes('github.com') || name.includes('://'))) {
         console.log(`  ${c.yellow}Not found in registry.${c.reset}`);
         console.log(`  ${c.dim}Starting audit for ${name}...${c.reset}`);
         console.log();
@@ -1650,7 +1677,8 @@ async function checkPackage(name) {
       console.log(`  ${c.yellow}✖  Not found${c.reset} — "${name}" hasn't been audited yet.`);
       console.log();
       console.log(`  ${c.dim}Next steps:${c.reset}`);
-      console.log(`    ${c.cyan}agentaudit audit <repo-url>${c.reset}    ${c.dim}Run a deep audit yourself${c.reset}`);
+      console.log(`    ${c.cyan}agentaudit check <repo-url>${c.reset}    ${c.dim}Auto-lookup + audit if not found${c.reset}`);
+      console.log(`    ${c.cyan}agentaudit audit <repo-url>${c.reset}    ${c.dim}Deep LLM audit${c.reset}`);
       console.log(`    ${c.cyan}agentaudit scan <repo-url>${c.reset}     ${c.dim}Quick static check (no API key)${c.reset}`);
     }
     return null;
@@ -1740,6 +1768,7 @@ async function main() {
     || process.env.AGENTAUDIT_MODEL
     || loadConfig()?.preferred_model
     || null;
+  globalModelOverride = modelOverride;
   
   // Strip global flags from args
   const globalFlags = new Set(['--json', '--quiet', '-q', '--no-color']);
@@ -1774,6 +1803,7 @@ async function main() {
     console.log(`  ${c.bold}SETUP${c.reset}`);
     console.log(`    ${c.cyan}status${c.reset}                       Check providers & API keys`);
     console.log(`    ${c.cyan}setup${c.reset}                        Register & configure`);
+    console.log(`    ${c.cyan}models${c.reset}                       List available LLM models`);
     console.log(`    ${c.cyan}config set${c.reset} <key> <value>     Set default provider/options`);
     console.log();
     console.log(`  ${c.bold}OPTIONS${c.reset}`);
@@ -1910,6 +1940,113 @@ async function main() {
     return;
   }
   
+  if (command === 'models') {
+    const anthropicKey = process.env.ANTHROPIC_API_KEY;
+    const openaiKey = process.env.OPENAI_API_KEY;
+    const openrouterKey = process.env.OPENROUTER_API_KEY;
+    
+    console.log(`  ${c.bold}Available models by provider:${c.reset}`);
+    console.log();
+    
+    // Static lists for Anthropic (no list API)
+    console.log(`  ${c.bold}Anthropic${c.reset}${anthropicKey ? ` ${c.green}(configured)${c.reset}` : ` ${c.dim}(not configured)${c.reset}`}`);
+    console.log(`    ${c.dim}claude-sonnet-4-20250514${c.reset}      ${c.dim}(default)${c.reset}`);
+    console.log(`    ${c.dim}claude-opus-4-20250514${c.reset}`);
+    console.log(`    ${c.dim}claude-haiku-3-20250514${c.reset}`);
+    console.log();
+    
+    // Static list for OpenAI
+    console.log(`  ${c.bold}OpenAI${c.reset}${openaiKey ? ` ${c.green}(configured)${c.reset}` : ` ${c.dim}(not configured)${c.reset}`}`);
+    console.log(`    ${c.dim}gpt-4o${c.reset}                        ${c.dim}(default)${c.reset}`);
+    console.log(`    ${c.dim}gpt-4o-mini${c.reset}`);
+    console.log(`    ${c.dim}gpt-4.1${c.reset}`);
+    console.log(`    ${c.dim}gpt-4.1-mini${c.reset}`);
+    console.log(`    ${c.dim}o3${c.reset}`);
+    console.log(`    ${c.dim}o4-mini${c.reset}`);
+    console.log();
+    
+    // OpenRouter — fetch from API
+    console.log(`  ${c.bold}OpenRouter${c.reset}${openrouterKey ? ` ${c.green}(configured)${c.reset}` : ` ${c.dim}(not configured)${c.reset}`}`);
+    if (openrouterKey || targets.includes('--all')) {
+      process.stdout.write(`    ${c.dim}Fetching models...${c.reset}`);
+      try {
+        const res = await fetch('https://openrouter.ai/api/v1/models', {
+          headers: openrouterKey ? { 'Authorization': `Bearer ${openrouterKey}` } : {},
+          signal: AbortSignal.timeout(10_000),
+        });
+        const data = await res.json();
+        const models = (data.data || [])
+          .filter(m => m.id && !m.id.includes(':free') && !m.id.includes('/extended'))
+          .sort((a, b) => (a.id || '').localeCompare(b.id || ''));
+        
+        // Group by provider prefix
+        const groups = {};
+        for (const m of models) {
+          const [prefix] = m.id.split('/');
+          if (!groups[prefix]) groups[prefix] = [];
+          groups[prefix].push(m);
+        }
+        
+        // Show popular ones first
+        const popular = ['anthropic', 'openai', 'google', 'meta-llama', 'mistralai', 'deepseek'];
+        const shown = new Set();
+        process.stdout.write(`\r    ${c.green}${models.length} models available${c.reset}                    \n`);
+        console.log();
+        
+        for (const prefix of popular) {
+          if (!groups[prefix]) continue;
+          shown.add(prefix);
+          console.log(`    ${c.bold}${prefix}${c.reset}`);
+          for (const m of groups[prefix].slice(0, 5)) {
+            console.log(`      ${c.dim}${m.id}${c.reset}`);
+          }
+          if (groups[prefix].length > 5) {
+            console.log(`      ${c.dim}... and ${groups[prefix].length - 5} more${c.reset}`);
+          }
+        }
+        
+        const otherCount = Object.keys(groups).filter(k => !shown.has(k)).length;
+        if (otherCount > 0) {
+          console.log();
+          console.log(`    ${c.dim}+ ${otherCount} more providers. Use --model=<provider/model>${c.reset}`);
+          console.log(`    ${c.dim}Full list: https://openrouter.ai/models${c.reset}`);
+        }
+      } catch (e) {
+        process.stdout.write(`\r    ${c.red}Failed to fetch: ${e.message}${c.reset}                    \n`);
+      }
+    } else {
+      console.log(`    ${c.dim}anthropic/claude-sonnet-4${c.reset}    ${c.dim}(default)${c.reset}`);
+      console.log(`    ${c.dim}Set OPENROUTER_API_KEY to see all ${c.bold}200+${c.reset}${c.dim} models${c.reset}`);
+      console.log(`    ${c.dim}Or browse: https://openrouter.ai/models${c.reset}`);
+    }
+    console.log();
+    
+    // Ollama
+    const ollamaModel = process.env.OLLAMA_MODEL;
+    const ollamaHost = process.env.OLLAMA_HOST || 'http://localhost:11434';
+    console.log(`  ${c.bold}Ollama${c.reset}${ollamaModel ? ` ${c.green}(configured: ${ollamaModel})${c.reset}` : ` ${c.dim}(not configured)${c.reset}`}`);
+    if (ollamaModel || process.env.OLLAMA_HOST) {
+      try {
+        const res = await fetch(`${ollamaHost}/api/tags`, { signal: AbortSignal.timeout(5_000) });
+        const data = await res.json();
+        for (const m of (data.models || []).slice(0, 10)) {
+          console.log(`    ${c.dim}${m.name}${c.reset}`);
+        }
+      } catch {
+        console.log(`    ${c.dim}(Ollama not running at ${ollamaHost})${c.reset}`);
+      }
+    } else {
+      console.log(`    ${c.dim}Set OLLAMA_MODEL to use local models${c.reset}`);
+    }
+    console.log();
+    
+    console.log(`  ${c.bold}Set model:${c.reset}`);
+    console.log(`    ${c.cyan}agentaudit config set model <name>${c.reset}`);
+    console.log(`    ${c.cyan}agentaudit audit <url> --model <name>${c.reset}`);
+    console.log(`    ${c.dim}Or env: AGENTAUDIT_MODEL=<name>${c.reset}`);
+    return;
+  }
+  
   if (command === 'config') {
     const subCmd = targets[0];
     if (subCmd === 'set' && targets[1] === 'provider' && targets[2]) {
@@ -1961,8 +2098,9 @@ async function main() {
       return;
     }
     const results = [];
+    const allowAutoAudit = command === 'check'; // only 'check' auto-audits, 'lookup' never does
     for (const t of names) {
-      const data = await checkPackage(t);
+      const data = await checkPackage(t, { autoAudit: allowAutoAudit });
       results.push(data);
     }
     if (jsonMode) {
@@ -2033,7 +2171,7 @@ async function main() {
   }
   
   // Typo correction via Levenshtein distance
-  const knownCommands = ['discover', 'scan', 'audit', 'check', 'lookup', 'status', 'setup', 'config'];
+  const knownCommands = ['discover', 'scan', 'audit', 'check', 'lookup', 'status', 'setup', 'config', 'models'];
   const suggestion = knownCommands
     .map(cmd => ({ cmd, dist: levenshtein(command, cmd) }))
     .filter(x => x.dist <= 3)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentaudit",
-  "version": "3.9.21",
+  "version": "3.9.23",
   "description": "Security scanner for AI packages — MCP server + CLI",
   "type": "module",
   "bin": {