agentaudit 3.9.31 → 3.9.33

package/cli.mjs

@@ -1734,11 +1734,55 @@ async function auditRepo(url) {
         console.log(`  ${c.dim}Report: ${REGISTRY_URL}/skills/${reportSlug}${c.reset}`);
         // Refresh stats cache in background
         if (creds.agent_name) refreshStatsCache(creds.agent_name).catch(() => {});
+        // Fetch registry consensus after upload
+        try {
+          const regData = await checkRegistry(reportSlug);
+          if (regData) {
+            const regRisk = regData.latest_risk_score ?? regData.risk_score ?? 0;
+            const regTrust = regData.trust_score ?? (100 - regRisk);
+            const totalReports = regData.total_reports ?? 1;
+            const uniqueAgents = regData.unique_agents ?? 1;
+            const confidence = regData.confidence ?? 'unverified';
+            const totalFindings = regData.total_findings ?? 0;
+            const hasOfficial = regData.has_official_audit;
+
+            // Show registry consensus if different from own report or multiple reports exist
+            if (totalReports > 1 || regRisk !== report.risk_score) {
+              console.log();
+              console.log(`  ${c.bold}Registry Consensus${c.reset}`);
+              const trustColor = regTrust >= 70 ? c.green : regTrust >= 40 ? c.yellow : c.red;
+              const trustLabel = regTrust >= 70 ? 'SAFE' : regTrust >= 40 ? 'CAUTION' : 'UNSAFE';
+              console.log(`  ${trustColor}${c.bold}${trustLabel}${c.reset}  Trust Score: ${trustColor}${regTrust}/100${c.reset}  ${c.dim}(across ${totalReports} reports from ${uniqueAgents} auditor${uniqueAgents !== 1 ? 's' : ''})${c.reset}`);
+              if (totalFindings > 0) {
+                console.log(`  ${c.dim}Total findings across all reports: ${totalFindings}${c.reset}`);
+              }
+              const confDisplay = {
+                consensus: { icon: '🟢', label: 'Consensus Certified', color: c.green },
+                verified: { icon: '🟢', label: 'Verified', color: c.green },
+                low: { icon: '🟡', label: 'Low Confidence', color: c.yellow },
+                unverified: { icon: '🔴', label: 'Unverified', color: c.yellow },
+              }[confidence] || { icon: '⚪', label: confidence, color: c.dim };
+              console.log(`  ${confDisplay.icon}  ${confDisplay.color}${confDisplay.label}${c.reset}`);
+              if (hasOfficial) console.log(`  ${c.green}✔ Officially audited${c.reset}`);
+
+              // Warn if own report disagrees with consensus
+              const ownRisk = report.risk_score || 0;
+              if (Math.abs(ownRisk - regRisk) > 10) {
+                console.log();
+                console.log(`  ${c.yellow}⚠  Your audit (risk ${ownRisk}) differs from registry consensus (risk ${regRisk}).${c.reset}`);
+                console.log(`  ${c.dim}   This may indicate model-specific blind spots or a changing codebase.${c.reset}`);
+              }
+            }
+          }
+        } catch {}
       } else {
+        const errBody = await res.text().catch(() => '');
         console.log(` ${c.yellow}failed (HTTP ${res.status})${c.reset}`);
+        if (process.argv.includes('--debug')) console.log(`  ${c.dim}Response: ${errBody.slice(0, 500)}${c.reset}`);
       }
     } catch (err) {
       console.log(` ${c.yellow}failed${c.reset}`);
+      if (process.argv.includes('--debug')) console.log(`  ${c.dim}Error: ${err.message}${c.reset}`);
     }
   } else {
     console.log(`  ${c.dim}Run ${c.cyan}agentaudit setup${c.dim} to upload reports to the registry${c.reset}`);
@@ -1751,12 +1795,14 @@ async function auditRepo(url) {
 // ── Check command ───────────────────────────────────────
 
 async function checkPackage(name, { autoAudit = false } = {}) {
+  // Derive slug from URL for registry lookup (URLs won't match as-is)
+  const slug = (name.includes('github.com') || name.includes('://')) ? slugFromUrl(name) : name.toLowerCase();
   if (!jsonMode) {
     console.log(`${icons.info}  Looking up ${c.bold}${name}${c.reset} in registry...`);
     console.log();
   }
   
-  const data = await checkRegistry(name);
+  const data = await checkRegistry(slug);
   if (!data) {
     if (!jsonMode) {
       // Auto-audit: only when called from 'check' command AND input looks like a URL

package/index.mjs

@@ -534,7 +534,27 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         try { data = JSON.parse(body); } catch { data = { raw: body }; }
 
         if (res.ok) {
-          return { content: [{ type: 'text', text: `✅ Report submitted!\n\nReport ID: ${data.report_id || 'unknown'}\nURL: ${REGISTRY_URL}/skills/${report.skill_slug}\nRisk: ${report.risk_score}/100 (${report.result})\nFindings: ${report.findings_count}` }] };
+          const reportSlug = data?.skill_slug || report.skill_slug;
+          // Fetch registry consensus to give the agent full decision context
+          let consensusInfo = '';
+          try {
+            const regRes = await fetch(`${REGISTRY_URL}/api/skills/${encodeURIComponent(reportSlug)}`, { signal: AbortSignal.timeout(5000) });
+            if (regRes.ok) {
+              const reg = await regRes.json();
+              const regRisk = reg.latest_risk_score ?? 0;
+              const regTrust = reg.trust_score ?? (100 - regRisk);
+              const totalReports = reg.total_reports ?? 1;
+              const uniqueAgents = reg.unique_agents ?? 1;
+              const confidence = reg.confidence ?? 'unverified';
+              const totalFindings = reg.total_findings ?? 0;
+              const trustLabel = regTrust >= 70 ? 'SAFE' : regTrust >= 40 ? 'CAUTION' : 'UNSAFE';
+              consensusInfo = `\n\n📊 **Registry Consensus** (across ${totalReports} reports from ${uniqueAgents} auditor${uniqueAgents !== 1 ? 's' : ''}):\n- Trust Score: ${regTrust}/100 (${trustLabel})\n- Total Findings: ${totalFindings}\n- Confidence: ${confidence}${reg.has_official_audit ? '\n- ✔ Officially audited' : ''}`;
+              if (totalReports > 1) {
+                consensusInfo += `\n\n⚠️ IMPORTANT: Your audit is ONE data point. The registry consensus reflects ALL audits. If your result differs significantly, this may indicate model-specific blind spots. Agents should use the REGISTRY CONSENSUS (not just this single audit) when making install/trust decisions.`;
+              }
+            }
+          } catch {}
+          return { content: [{ type: 'text', text: `✅ Report submitted!\n\nReport ID: ${data.report_id || 'unknown'}\nURL: ${REGISTRY_URL}/skills/${reportSlug}\nYour Audit: Risk ${report.risk_score}/100 (${report.result}), ${report.findings_count} findings${consensusInfo}` }] };
         } else {
           return { content: [{ type: 'text', text: `Upload failed (HTTP ${res.status}): ${JSON.stringify(data, null, 2)}` }] };
         }
@@ -584,8 +604,22 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           summary += `⚠️ OUTDATED: The package has changed since the last audit. Consider running a fresh audit first.\n\n`;
         }
 
+        // Consensus section — critical for agent decision-making
+        const totalReports = data.total_reports ?? 1;
+        const uniqueAgents = data.unique_agents ?? 1;
+        const confidence = data.confidence ?? 'unverified';
+        const trustScore = data.trust_score ?? (100 - (risk || 0));
+        const trustLabel = trustScore >= 70 ? 'SAFE' : trustScore >= 40 ? 'CAUTION' : 'UNSAFE';
+
+        summary += `--- Registry Consensus ---\n`;
+        summary += `Trust Score: ${trustScore}/100 (${trustLabel})\n`;
+        summary += `Reports: ${totalReports} from ${uniqueAgents} independent auditor${uniqueAgents !== 1 ? 's' : ''}\n`;
+        summary += `Confidence: ${confidence}\n`;
+        if (confidence === 'unverified') summary += `⚠️ Only 1 audit exists — consider running your own for independent verification.\n`;
+        if (confidence === 'low') summary += `⚠️ Limited independent verification — more auditors needed for consensus.\n`;
+
         // Details section
-        summary += `--- Details ---\n`;
+        summary += `\n--- Details ---\n`;
         summary += `Package: ${package_name}\n`;
         summary += `Status: ${official}\n`;
         summary += `Last Audited: ${auditedAt}\n`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentaudit",
-  "version": "3.9.31",
+  "version": "3.9.33",
   "description": "Security scanner for AI packages — MCP server + CLI",
   "type": "module",
   "bin": {