agentaudit 3.9.22 → 3.9.23

package/cli.mjs

@@ -39,7 +39,7 @@ function resolveProvider(flagOverride, keys) {
   // Aliases
   const aliases = { claude: 'anthropic', gpt: 'openai', 'gpt-4o': 'openai', 'gpt4': 'openai', or: 'openrouter', local: 'ollama' };
 
-  // Priority: --provider flag > AGENTAUDIT_PROVIDER env > config file > auto-detect
+  // Priority: --provider flag > AGENTAUDIT_PROVIDER env > config file > model-inferred > auto-detect
   const preferred = flagOverride
     || process.env.AGENTAUDIT_PROVIDER?.toLowerCase()
     || loadConfig()?.preferred_provider
@@ -51,6 +51,14 @@ function resolveProvider(flagOverride, keys) {
     if (!p) return null;
     return p;
   }
+  
+  // Smart inference: if model override looks like "provider/model" (e.g. z-ai/glm-5, anthropic/claude-sonnet-4)
+  // → auto-select OpenRouter (which uses that format)
+  const activeModel = globalModelOverride || process.env.AGENTAUDIT_MODEL || loadConfig()?.preferred_model;
+  if (activeModel && activeModel.includes('/') && providers.openrouter) {
+    return providers.openrouter;
+  }
+  
   // Auto-detect priority: Anthropic > OpenAI > OpenRouter > Custom > Ollama (local last — usually weaker)
   return providers.anthropic || providers.openai || providers.openrouter || providers.custom || providers.ollama || null;
 }
@@ -59,6 +67,7 @@ function resolveProvider(flagOverride, keys) {
 let jsonMode = false;
 let quietMode = false;
 let modelOverride = null; // --model flag or AGENTAUDIT_MODEL env or config
+let globalModelOverride = null; // same, but set early for resolveProvider
 
 // ── ANSI Colors (respects NO_COLOR and --no-color) ───────
 
@@ -1457,8 +1466,22 @@ async function auditRepo(url) {
     return null;
   }
   
+  // Determine actual model name for display
+  let actualModel;
+  if (resolvedProvider.id === 'anthropic') {
+    actualModel = modelOverride || 'claude-sonnet-4-20250514';
+  } else if (resolvedProvider.id === 'openrouter') {
+    actualModel = modelOverride || process.env.OPENROUTER_MODEL || 'anthropic/claude-sonnet-4';
+  } else if (resolvedProvider.id === 'openai') {
+    actualModel = modelOverride || 'gpt-4o';
+  } else if (resolvedProvider.id === 'ollama') {
+    actualModel = modelOverride || resolvedProvider.model;
+  } else {
+    actualModel = modelOverride || resolvedProvider.model || 'unknown';
+  }
+  
   // We have an API key — run LLM audit
-  process.stdout.write(`  ${c.dim}[4/4]${c.reset} Running LLM analysis ${c.dim}(${activeProvider})${c.reset}...`);
+  process.stdout.write(`  ${c.dim}[4/4]${c.reset} Running LLM analysis ${c.dim}(${resolvedProvider.id}: ${actualModel})${c.reset}...`);
   
   const systemPrompt = auditPrompt || 'You are a security auditor. Analyze the code and report findings as JSON.';
   const userMessage = [
@@ -1579,7 +1602,11 @@ async function auditRepo(url) {
   // Display results
   console.log();
   const riskScore = report.risk_score || 0;
-  console.log(`  ${riskBadge(riskScore)} Risk ${riskScore}/100  ${c.bold}${report.result || 'unknown'}${c.reset}`);
+  const trustScore = 100 - riskScore;
+  const trustColor = trustScore >= 70 ? c.green : trustScore >= 40 ? c.yellow : c.red;
+  const trustLabel = trustScore >= 70 ? 'SAFE' : trustScore >= 40 ? 'CAUTION' : 'UNSAFE';
+  console.log(`  ${trustColor}${c.bold}${trustLabel}${c.reset}  ${trustColor}Trust Score: ${trustScore}/100${c.reset}  ${c.dim}(Risk: ${riskScore}/100)${c.reset}`);
+  console.log(`  ${c.dim}Model: ${resolvedProvider.id}/${actualModel}  Duration: ${elapsed(start)}${c.reset}`);
   console.log();
   
   if (report.findings && report.findings.length > 0) {
@@ -1608,7 +1635,7 @@ async function auditRepo(url) {
           'Authorization': `Bearer ${creds.api_key}`,
           'Content-Type': 'application/json',
         },
-        body: JSON.stringify(report),
+        body: JSON.stringify({ ...report, audit_model: actualModel, audit_provider: resolvedProvider.id }),
         signal: AbortSignal.timeout(15_000),
       });
       if (res.ok) {
@@ -1741,6 +1768,7 @@ async function main() {
     || process.env.AGENTAUDIT_MODEL
     || loadConfig()?.preferred_model
     || null;
+  globalModelOverride = modelOverride;
   
   // Strip global flags from args
   const globalFlags = new Set(['--json', '--quiet', '-q', '--no-color']);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentaudit",
-  "version": "3.9.22",
+  "version": "3.9.23",
   "description": "Security scanner for AI packages — MCP server + CLI",
   "type": "module",
   "bin": {