agentaudit 3.9.24 → 3.9.26

package/cli.mjs

@@ -388,7 +388,14 @@ function banner() {
 
 function slugFromUrl(url) {
   const match = url.match(/github\.com\/([^/]+)\/([^/.\s]+)/);
-  if (match) return match[2].toLowerCase().replace(/[^a-z0-9-]/g, '-');
+  if (match) {
+    const owner = match[1].toLowerCase().replace(/[^a-z0-9-]/g, '-');
+    const repo = match[2].toLowerCase().replace(/[^a-z0-9-]/g, '-');
+    // Generic repo names get owner prefix to avoid collisions
+    const generic = ['mcp', 'server', 'plugin', 'tool', 'agent', 'sdk', 'api', 'app', 'cli', 'lib', 'core'];
+    if (generic.includes(repo)) return `${owner}-${repo}`;
+    return repo;
+  }
   return url.replace(/[^a-z0-9]/gi, '-').toLowerCase().slice(0, 60);
 }
 
@@ -1506,6 +1513,7 @@ async function auditRepo(url) {
   
   let report = null;
   let _lastLlmText = '';
+  let providerMeta = {}; // Collect provider metadata for attestation
   
   try {
     if (resolvedProvider.id === 'anthropic') {
@@ -1534,6 +1542,12 @@ async function auditRepo(url) {
       const text = data.content?.[0]?.text || '';
       _lastLlmText = text;
       report = extractJSON(text);
+      providerMeta = {
+        provider_msg_id: data.id || null,
+        input_tokens: data.usage?.input_tokens || null,
+        output_tokens: data.usage?.output_tokens || null,
+        reported_model: data.model || null,
+      };
     } else {
       // OpenAI, OpenRouter, Ollama, or Custom (all use OpenAI-compatible chat completions API)
       let apiUrl, modelName, authHeaders;
@@ -1582,6 +1596,13 @@ async function auditRepo(url) {
       const text = data.choices?.[0]?.message?.content || '';
       _lastLlmText = text;
       report = extractJSON(text);
+      providerMeta = {
+        provider_msg_id: data.id || null,
+        provider_fingerprint: data.system_fingerprint || null,
+        input_tokens: data.usage?.prompt_tokens || null,
+        output_tokens: data.usage?.completion_tokens || null,
+        reported_model: data.model || null,
+      };
     }
     
     console.log(` ${c.green}done${c.reset} ${c.dim}(${elapsed(start)})${c.reset}`);
@@ -1642,7 +1663,16 @@ async function auditRepo(url) {
           'Authorization': `Bearer ${creds.api_key}`,
           'Content-Type': 'application/json',
         },
-        body: JSON.stringify({ ...report, audit_model: actualModel, audit_provider: resolvedProvider.id }),
+        body: JSON.stringify({
+          ...report,
+          audit_model: providerMeta.reported_model || actualModel,
+          audit_provider: resolvedProvider.id,
+          provider_msg_id: providerMeta.provider_msg_id || undefined,
+          provider_fingerprint: providerMeta.provider_fingerprint || undefined,
+          input_tokens: providerMeta.input_tokens || undefined,
+          output_tokens: providerMeta.output_tokens || undefined,
+          audit_duration_ms: Date.now() - start,
+        }),
         signal: AbortSignal.timeout(15_000),
       });
       if (res.ok) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentaudit",
-  "version": "3.9.24",
+  "version": "3.9.26",
   "description": "Security scanner for AI packages — MCP server + CLI",
   "type": "module",
   "bin": {