agentaudit 3.9.32 → 3.9.34

package/cli.mjs

@@ -1704,6 +1704,17 @@ async function auditRepo(url) {
   
   // Upload to registry
   const creds = loadCredentials();
+  const finalModel = providerMeta.reported_model || actualModel;
+  const finalProvider = resolvedProvider.id;
+  if (!finalModel || finalModel === 'unknown') {
+    console.log(`  ${c.yellow}⚠  Model not detected — report will not include model attestation.${c.reset}`);
+    console.log(`  ${c.dim}   This usually means the LLM API did not return model info.${c.reset}`);
+    console.log(`  ${c.dim}   Try: agentaudit config set model <model-name>${c.reset}`);
+    if (process.argv.includes('--debug')) {
+      console.log(`  ${c.dim}   providerMeta: ${JSON.stringify(providerMeta)}${c.reset}`);
+      console.log(`  ${c.dim}   actualModel: ${actualModel}, resolvedProvider: ${resolvedProvider.id}${c.reset}`);
+    }
+  }
   if (creds) {
     process.stdout.write(`  Uploading report to registry...`);
     try {
@@ -1717,8 +1728,8 @@ async function auditRepo(url) {
           ...report,
           commit_sha: report.commit_sha || repoCommitSha || undefined,
           package_version: report.package_version || repoPackageVersion || undefined,
-          audit_model: providerMeta.reported_model || actualModel,
-          audit_provider: resolvedProvider.id,
+          audit_model: finalModel !== 'unknown' ? finalModel : undefined,
+          audit_provider: finalProvider,
           provider_msg_id: providerMeta.provider_msg_id || undefined,
           provider_fingerprint: providerMeta.provider_fingerprint || undefined,
           input_tokens: providerMeta.input_tokens || undefined,
@@ -1732,13 +1743,63 @@ async function auditRepo(url) {
         const reportSlug = data?.skill_slug || data?.slug || slug;
         console.log(` ${c.green}done${c.reset}`);
         console.log(`  ${c.dim}Report: ${REGISTRY_URL}/skills/${reportSlug}${c.reset}`);
+        // Show API warnings
+        if (data?.warnings?.length) {
+          for (const w of data.warnings) {
+            console.log(`  ${c.yellow}⚠  ${w}${c.reset}`);
+          }
+        }
         // Refresh stats cache in background
         if (creds.agent_name) refreshStatsCache(creds.agent_name).catch(() => {});
+        // Fetch registry consensus after upload
+        try {
+          const regData = await checkRegistry(reportSlug);
+          if (regData) {
+            const regRisk = regData.latest_risk_score ?? regData.risk_score ?? 0;
+            const regTrust = regData.trust_score ?? (100 - regRisk);
+            const totalReports = regData.total_reports ?? 1;
+            const uniqueAgents = regData.unique_agents ?? 1;
+            const confidence = regData.confidence ?? 'unverified';
+            const totalFindings = regData.total_findings ?? 0;
+            const hasOfficial = regData.has_official_audit;
+
+            // Show registry consensus if different from own report or multiple reports exist
+            if (totalReports > 1 || regRisk !== report.risk_score) {
+              console.log();
+              console.log(`  ${c.bold}Registry Consensus${c.reset}`);
+              const trustColor = regTrust >= 70 ? c.green : regTrust >= 40 ? c.yellow : c.red;
+              const trustLabel = regTrust >= 70 ? 'SAFE' : regTrust >= 40 ? 'CAUTION' : 'UNSAFE';
+              console.log(`  ${trustColor}${c.bold}${trustLabel}${c.reset}  Trust Score: ${trustColor}${regTrust}/100${c.reset}  ${c.dim}(across ${totalReports} reports from ${uniqueAgents} auditor${uniqueAgents !== 1 ? 's' : ''})${c.reset}`);
+              if (totalFindings > 0) {
+                console.log(`  ${c.dim}Total findings across all reports: ${totalFindings}${c.reset}`);
+              }
+              const confDisplay = {
+                consensus: { icon: '🟢', label: 'Consensus Certified', color: c.green },
+                verified: { icon: '🟢', label: 'Verified', color: c.green },
+                low: { icon: '🟡', label: 'Low Confidence', color: c.yellow },
+                unverified: { icon: '🔴', label: 'Unverified', color: c.yellow },
+              }[confidence] || { icon: '⚪', label: confidence, color: c.dim };
+              console.log(`  ${confDisplay.icon}  ${confDisplay.color}${confDisplay.label}${c.reset}`);
+              if (hasOfficial) console.log(`  ${c.green}✔ Officially audited${c.reset}`);
+
+              // Warn if own report disagrees with consensus
+              const ownRisk = report.risk_score || 0;
+              if (Math.abs(ownRisk - regRisk) > 10) {
+                console.log();
+                console.log(`  ${c.yellow}⚠  Your audit (risk ${ownRisk}) differs from registry consensus (risk ${regRisk}).${c.reset}`);
+                console.log(`  ${c.dim}   This may indicate model-specific blind spots or a changing codebase.${c.reset}`);
+              }
+            }
+          }
+        } catch {}
       } else {
+        const errBody = await res.text().catch(() => '');
         console.log(` ${c.yellow}failed (HTTP ${res.status})${c.reset}`);
+        if (process.argv.includes('--debug')) console.log(`  ${c.dim}Response: ${errBody.slice(0, 500)}${c.reset}`);
       }
     } catch (err) {
       console.log(` ${c.yellow}failed${c.reset}`);
+      if (process.argv.includes('--debug')) console.log(`  ${c.dim}Error: ${err.message}${c.reset}`);
     }
   } else {
     console.log(`  ${c.dim}Run ${c.cyan}agentaudit setup${c.dim} to upload reports to the registry${c.reset}`);

package/index.mjs

@@ -534,7 +534,27 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         try { data = JSON.parse(body); } catch { data = { raw: body }; }
 
         if (res.ok) {
-          return { content: [{ type: 'text', text: `✅ Report submitted!\n\nReport ID: ${data.report_id || 'unknown'}\nURL: ${REGISTRY_URL}/skills/${report.skill_slug}\nRisk: ${report.risk_score}/100 (${report.result})\nFindings: ${report.findings_count}` }] };
+          const reportSlug = data?.skill_slug || report.skill_slug;
+          // Fetch registry consensus to give the agent full decision context
+          let consensusInfo = '';
+          try {
+            const regRes = await fetch(`${REGISTRY_URL}/api/skills/${encodeURIComponent(reportSlug)}`, { signal: AbortSignal.timeout(5000) });
+            if (regRes.ok) {
+              const reg = await regRes.json();
+              const regRisk = reg.latest_risk_score ?? 0;
+              const regTrust = reg.trust_score ?? (100 - regRisk);
+              const totalReports = reg.total_reports ?? 1;
+              const uniqueAgents = reg.unique_agents ?? 1;
+              const confidence = reg.confidence ?? 'unverified';
+              const totalFindings = reg.total_findings ?? 0;
+              const trustLabel = regTrust >= 70 ? 'SAFE' : regTrust >= 40 ? 'CAUTION' : 'UNSAFE';
+              consensusInfo = `\n\n📊 **Registry Consensus** (across ${totalReports} reports from ${uniqueAgents} auditor${uniqueAgents !== 1 ? 's' : ''}):\n- Trust Score: ${regTrust}/100 (${trustLabel})\n- Total Findings: ${totalFindings}\n- Confidence: ${confidence}${reg.has_official_audit ? '\n- ✔ Officially audited' : ''}`;
+              if (totalReports > 1) {
+                consensusInfo += `\n\n⚠️ IMPORTANT: Your audit is ONE data point. The registry consensus reflects ALL audits. If your result differs significantly, this may indicate model-specific blind spots. Agents should use the REGISTRY CONSENSUS (not just this single audit) when making install/trust decisions.`;
+              }
+            }
+          } catch {}
+          return { content: [{ type: 'text', text: `✅ Report submitted!\n\nReport ID: ${data.report_id || 'unknown'}\nURL: ${REGISTRY_URL}/skills/${reportSlug}\nYour Audit: Risk ${report.risk_score}/100 (${report.result}), ${report.findings_count} findings${consensusInfo}` }] };
         } else {
           return { content: [{ type: 'text', text: `Upload failed (HTTP ${res.status}): ${JSON.stringify(data, null, 2)}` }] };
         }
@@ -584,8 +604,22 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           summary += `⚠️ OUTDATED: The package has changed since the last audit. Consider running a fresh audit first.\n\n`;
         }
 
+        // Consensus section — critical for agent decision-making
+        const totalReports = data.total_reports ?? 1;
+        const uniqueAgents = data.unique_agents ?? 1;
+        const confidence = data.confidence ?? 'unverified';
+        const trustScore = data.trust_score ?? (100 - (risk || 0));
+        const trustLabel = trustScore >= 70 ? 'SAFE' : trustScore >= 40 ? 'CAUTION' : 'UNSAFE';
+
+        summary += `--- Registry Consensus ---\n`;
+        summary += `Trust Score: ${trustScore}/100 (${trustLabel})\n`;
+        summary += `Reports: ${totalReports} from ${uniqueAgents} independent auditor${uniqueAgents !== 1 ? 's' : ''}\n`;
+        summary += `Confidence: ${confidence}\n`;
+        if (confidence === 'unverified') summary += `⚠️ Only 1 audit exists — consider running your own for independent verification.\n`;
+        if (confidence === 'low') summary += `⚠️ Limited independent verification — more auditors needed for consensus.\n`;
+
         // Details section
-        summary += `--- Details ---\n`;
+        summary += `\n--- Details ---\n`;
         summary += `Package: ${package_name}\n`;
         summary += `Status: ${official}\n`;
         summary += `Last Audited: ${auditedAt}\n`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentaudit",
-  "version": "3.9.32",
+  "version": "3.9.34",
   "description": "Security scanner for AI packages — MCP server + CLI",
   "type": "module",
   "bin": {