agentverify 1.3.0 → 1.4.0

package/CHANGELOG.md

@@ -0,0 +1,28 @@
+# Changelog
+
+All notable changes to the `agentverify` CLI/SDK package are documented here.
+
+## [1.4.0] - Unreleased
+
+### Changed — CI exit codes now distinguish a security failure from an execution error (behavior change)
+
+Previously, `--ci` mode used exit code `1` for **both** a real `NOT_VERIFIED` verdict **and** any execution error (missing/invalid API key, network failure, missing file). That made it impossible for a pipeline to tell "the agent failed the security check" apart from "the scan itself couldn't run."
+
+New exit codes:
+
+| Code | Meaning | Previously |
+| --- | --- | --- |
+| `0` | All scanned files verified | `0` (unchanged) |
+| `1` | `NOT_VERIFIED` — a real security/verification failure | `1` (unchanged) |
+| `2` | `NOT_ASSESSED` — insufficient evidence for a verdict | `2` (unchanged) |
+| `3` | **New.** Execution error — bad/missing API key, network failure, missing file, unknown command | was `1` |
+
+**If your pipeline only checks `exit code != 0` to block a deployment, this is not a breaking change** — every previously-non-zero case is still non-zero. **If your pipeline branches on the exact code `1`**, an execution error will now surface as `3` instead — update any such logic to treat both `1` and `3` as failures, or to react differently to `3` (an infrastructure problem, not a security finding).
+
+### Fixed
+
+- Scanner: findings that reference a detected credential no longer include the live secret value in `evidence` — only a redacted preview (e.g. `api_key: "sk_l****" (redacted)`). Affects report evidence produced by any scan, including those made public via report sharing.
+
+## [1.3.0] - 2026-07-13
+
+Initial public release. See git history for prior changes.

package/README.md

@@ -51,6 +51,17 @@ agentverify scan ./agents --ci
 
 Normal scans print findings without failing the shell just because issues exist. CI mode is stricter: it exits non-zero when an agent is `NOT_VERIFIED`, when a scan errors, or when submitted content cannot be assessed.
 
+Exit codes distinguish a security/verification result from an application error, so a pipeline can tell "the agent failed the check" apart from "the scan itself couldn't run":
+
+| Code | Meaning |
+| --- | --- |
+| `0` | All scanned files verified |
+| `1` | `NOT_VERIFIED` — a security/verification check failed |
+| `2` | `NOT_ASSESSED` — insufficient evidence for a verdict (see `--allow-not-assessed`) |
+| `3` | Execution error — the scan itself could not run (bad key, network failure, missing file) |
+
+All non-zero codes still fail a pipeline step by default, so an existing `if [ $? -ne 0 ]`-style check keeps working unchanged.
+
 ## SDK Usage
 
 ```ts
@@ -105,7 +116,7 @@ The workflow requires a valid `AGENTVERIFY_API_KEY`. The local Worker code path
 
 Saved CLI reports sync to the dashboard through the API `cliReports` save path. If the API cannot save the report, the CLI still prints local scan output and tells you dashboard sync did not complete.
 
-Verified reports can expose a README badge from the report page. A packaged Agent Verify GitHub Action with automatic PR comments is planned after the v1.3.0 app/CLI release candidate stabilizes.
+Verified reports can expose a README badge from the report page. A packaged Agent Verify GitHub Action (`AI-Blockchain-Ventures/agentverify@v1`) already exists and produces text/Markdown/JSON output plus an optional workflow artifact — see below. Automatically posting that output as a PR comment (rather than just producing it for you to post) is still a planned enhancement, not yet built.
 
 See the full GitHub Action guide at `docs/github-action.md` for composite action inputs, JSON/Markdown examples, branch protection, optional PR comments, and badge guidance.
 

package/dist/{chunk-PY3NS2YH.mjs → chunk-XVA2M2HS.mjs}

@@ -48,7 +48,12 @@ function normalizeScanResult(data) {
       scanDuration: 0
     },
     saved: data.saved === true,
-    reportUrl: data.reportUrl ?? null
+    reportUrl: data.reportUrl ?? null,
+    artifactFingerprint: data.artifactFingerprint,
+    reportIntegrity: data.reportIntegrity,
+    policyProfile: data.policyProfile ?? null,
+    policyResult: data.policyResult ?? null,
+    attestation: data.attestation ?? null
   };
 }
 async function scan(input, options) {
@@ -74,7 +79,8 @@ async function scan(input, options) {
       body: JSON.stringify({
         content: input.content,
         fileName: input.fileName ?? "agent",
-        platform: input.platform
+        platform: input.platform,
+        policyId: input.policyId
       }),
       signal: controller.signal
     });

package/dist/cli.js

@@ -55,7 +55,12 @@ function normalizeScanResult(data) {
       scanDuration: 0
     },
     saved: data.saved === true,
-    reportUrl: data.reportUrl ?? null
+    reportUrl: data.reportUrl ?? null,
+    artifactFingerprint: data.artifactFingerprint,
+    reportIntegrity: data.reportIntegrity,
+    policyProfile: data.policyProfile ?? null,
+    policyResult: data.policyResult ?? null,
+    attestation: data.attestation ?? null
   };
 }
 async function scan(input, options) {
@@ -81,7 +86,8 @@ async function scan(input, options) {
       body: JSON.stringify({
         content: input.content,
         fileName: input.fileName ?? "agent",
-        platform: input.platform
+        platform: input.platform,
+        policyId: input.policyId
       }),
       signal: controller.signal
     });
@@ -110,9 +116,13 @@ async function scan(input, options) {
 }
 
 // src/cli.ts
-var VERSION = "1.3.0";
+var VERSION = "1.4.0";
 var API_URL = process.env.AGENTVERIFY_API_URL ?? "https://agentverify-api.agentverify.workers.dev/v1/scan";
 var A2SPA_DOCS_URL = "https://aimodularity.com/A2SPA/docs";
+var EXIT_OK = 0;
+var EXIT_NOT_VERIFIED = 1;
+var EXIT_NOT_ASSESSED = 2;
+var EXIT_EXECUTION_ERROR = 3;
 var c = {
   reset: "\x1B[0m",
   bold: "\x1B[1m",
@@ -127,6 +137,7 @@ var c = {
 var write = (value = "") => process.stdout.write(`${value}
 `);
 var SUPPORTED_EXTENSIONS = /* @__PURE__ */ new Set([".js", ".ts", ".py", ".json", ".yaml", ".yml", ".md", ".mjs", ".cjs"]);
+var MAX_SCAN_FILE_BYTES = 5 * 1024 * 1024;
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", ".next", "vendor", "coverage", ".cache"]);
 function collectFiles(dir) {
   const files = [];
@@ -158,7 +169,9 @@ function parseArgs(argv) {
     ci: false,
     allowNotAssessed: false,
     help: false,
-    version: false
+    version: false,
+    policy: "",
+    summaryFile: ""
   };
   if (result.command === "--help" || result.command === "-h") {
     result.command = "";
@@ -176,6 +189,8 @@ function parseArgs(argv) {
     else if (arg === "--markdown") result.markdown = true;
     else if (arg === "--ci") result.ci = true;
     else if (arg === "--allow-not-assessed") result.allowNotAssessed = true;
+    else if (arg === "--policy") result.policy = args[++i] ?? "";
+    else if (arg === "--summary-file") result.summaryFile = args[++i] ?? "";
     else if (arg === "--help" || arg === "-h") result.help = true;
     else if (arg === "--version" || arg === "-v") result.version = true;
     else if (!arg.startsWith("-")) result.dir = arg;
@@ -203,6 +218,10 @@ ${c.bold}Options:${c.reset}
   --ci          CI mode: concise output and non-zero exit for NOT VERIFIED
   --allow-not-assessed
                 In CI mode, do not fail only because content is NOT_ASSESSED
+  --policy <id> Evaluate a built-in policy profile against this scan's evidence
+                in addition to the scanner's own verdict (e.g. financial-agent)
+  --summary-file <path>
+                Write results as JSON to this path (in addition to any other output)
   --version, -v Print version
   --help, -h    Show this help message
 
@@ -222,6 +241,12 @@ ${c.bold}Examples:${c.reset}
   ${c.gray}# Markdown summary for pull requests${c.reset}
   agentverify scan . --key av_your_key --markdown
 
+${c.bold}Exit codes (--ci):${c.reset}
+  0   All scanned files verified
+  1   NOT VERIFIED \u2014 a security/verification check failed
+  2   NOT ASSESSED \u2014 insufficient evidence for a verdict (see --allow-not-assessed)
+  3   Execution error \u2014 the scan itself could not run (bad key, network, missing file)
+
 ${c.bold}Get your API key:${c.reset}
   https://aimodularity.com/agentverify/dashboard
 
@@ -243,6 +268,16 @@ function getFixFirst(result) {
 function getRelevantThreatCategories(result) {
   return (result.threatCategories ?? []).filter((item) => item.status !== "not_assessed").slice(0, 6).map((item) => `${item.label} (${item.status.replace("_", " ")})`);
 }
+function criticalCount(result) {
+  return result.findings.filter((f) => f.severity === "critical").length;
+}
+function highCount(result) {
+  return result.findings.filter((f) => f.severity === "high").length;
+}
+function fingerprintPreview(result) {
+  const hash = result.artifactFingerprint?.artifactHash;
+  return hash ? `${hash.slice(0, 12)}\u2026` : null;
+}
 function printDetailedSummary(result, fileName) {
   const verified = result.verdict === "VERIFIED";
   const verdictColor = verified ? c.green : result.verdict === "NOT_ASSESSED" ? c.yellow : c.red;
@@ -253,6 +288,10 @@ ${c.bold}${c.cyan}Agent Verify${c.reset}`);
   write(`${c.bold}Verdict:${c.reset} ${verdictColor}${result.verdict === "NOT_VERIFIED" ? "NOT VERIFIED" : result.verdict.replace("_", " ")}${c.reset}`);
   write(`${c.bold}Risk level:${c.reset} ${result.riskLevel}`);
   write(`${c.bold}Confidence:${c.reset} ${result.confidence}/100`);
+  write(`${c.bold}Critical / High findings:${c.reset} ${criticalCount(result)} / ${highCount(result)}`);
+  if (result.metadata?.scannerVersion) write(`${c.bold}Ruleset version:${c.reset} ${result.metadata.scannerVersion}`);
+  if (fingerprintPreview(result)) write(`${c.bold}Artifact fingerprint:${c.reset} ${fingerprintPreview(result)}`);
+  if (result.policyProfile) write(`${c.bold}Policy (${result.policyProfile}):${c.reset} ${result.policyResult === "PASS" ? `${c.green}PASS${c.reset}` : `${c.red}FAIL${c.reset}`}`);
   write(`${c.bold}Top blocker:${c.reset} ${getTopBlocker(result)}`);
   write(`
 ${c.bold}Fix first:${c.reset}`);
@@ -279,7 +318,11 @@ function markdownSummary(results, summary) {
       lines.push(`## ${item.file}`, "", `Error: ${item.error ?? "Unknown error"}`, "");
       continue;
     }
-    lines.push(`## ${item.file}`, "", `Score: ${item.result.riskScore}/100`, `Verdict: ${item.result.verdict === "NOT_VERIFIED" ? "NOT VERIFIED" : item.result.verdict.replace("_", " ")}`, `Risk level: ${item.result.riskLevel}`, `Top blocker: ${getTopBlocker(item.result)}`, "");
+    lines.push(`## ${item.file}`, "", `Score: ${item.result.riskScore}/100`, `Verdict: ${item.result.verdict === "NOT_VERIFIED" ? "NOT VERIFIED" : item.result.verdict.replace("_", " ")}`, `Risk level: ${item.result.riskLevel}`, `Critical / High findings: ${criticalCount(item.result)} / ${highCount(item.result)}`);
+    if (item.result.metadata?.scannerVersion) lines.push(`Ruleset version: ${item.result.metadata.scannerVersion}`);
+    if (fingerprintPreview(item.result)) lines.push(`Artifact fingerprint: \`${fingerprintPreview(item.result)}\``);
+    if (item.result.policyProfile) lines.push(`Policy (${item.result.policyProfile}): ${item.result.policyResult}`);
+    lines.push(`Top blocker: ${getTopBlocker(item.result)}`, "");
     const fixes = getFixFirst(item.result);
     if (fixes.length) lines.push("Fix first:", ...fixes.map((fix, index) => `${index + 1}. ${fix}`), "");
     const threats = getRelevantThreatCategories(item.result);
@@ -289,6 +332,24 @@ function markdownSummary(results, summary) {
   lines.push(`A2SPA docs: ${A2SPA_DOCS_URL}`);
   return lines.join("\n");
 }
+function writeGithubJobSummary(results, summary) {
+  const summaryPath = process.env.GITHUB_STEP_SUMMARY;
+  if (!summaryPath) return;
+  try {
+    (0, import_fs.appendFileSync)(summaryPath, `${markdownSummary(results, summary)}
+`);
+  } catch (e) {
+    console.error(`Warning: could not write GitHub job summary: ${e instanceof Error ? e.message : e}`);
+  }
+}
+function writeSummaryFile(path, results, summary) {
+  if (!path) return;
+  try {
+    (0, import_fs.writeFileSync)(path, JSON.stringify({ results, summary }, null, 2));
+  } catch (e) {
+    console.error(`Warning: could not write summary file: ${e instanceof Error ? e.message : e}`);
+  }
+}
 function printVerdict(result, fileName) {
   const verified = result.verdict === "VERIFIED";
   const notAssessed = result.verdict === "NOT_ASSESSED";
@@ -311,7 +372,7 @@ ${c.red}Error:${c.reset} API key required
     console.error(`  Get your key at https://aimodularity.com/agentverify/dashboard/`);
     console.error(`  Example: AGENTVERIFY_API_KEY=av_your_key agentverify scan .
 `);
-    process.exit(1);
+    process.exit(EXIT_EXECUTION_ERROR);
   }
   let files = [];
   if (args.file) {
@@ -342,10 +403,14 @@ ${c.bold}Agent Verify${c.reset} ${c.gray}v${VERSION}${c.reset}`);
     const batch = files.slice(i, i + CONCURRENCY);
     const batchResults = await Promise.allSettled(
       batch.map(async (filePath) => {
+        const fileStat = (0, import_fs.statSync)(filePath);
+        if (fileStat.size > MAX_SCAN_FILE_BYTES) {
+          throw new Error(`File is ${(fileStat.size / 1024 / 1024).toFixed(1)}MB, over the ${MAX_SCAN_FILE_BYTES / 1024 / 1024}MB scan limit \u2014 skipped`);
+        }
         const content = (0, import_fs.readFileSync)(filePath, "utf-8");
         const relPath = (0, import_path.relative)(args.dir === "." ? process.cwd() : args.dir, filePath);
         const result = await scan(
-          { content, fileName: relPath },
+          { content, fileName: relPath, policyId: args.policy || void 0 },
           { apiKey: args.key, apiUrl: API_URL }
         );
         return { filePath, relPath, result };
@@ -376,21 +441,23 @@ ${c.bold}Agent Verify${c.reset} ${c.gray}v${VERSION}${c.reset}`);
     }
   }
   const summary = { total: files.length, verified, notVerified, notAssessed, errors };
+  writeGithubJobSummary(jsonResults, summary);
+  writeSummaryFile(args.summaryFile, jsonResults, summary);
   if (args.json) {
     write(JSON.stringify({ results: jsonResults, summary }, null, 2));
-    if (errors > 0) process.exit(1);
+    if (errors > 0) process.exit(EXIT_EXECUTION_ERROR);
     if (args.ci) {
-      if (notVerified > 0) process.exit(1);
-      if (notAssessed > 0 && !args.allowNotAssessed) process.exit(2);
+      if (notVerified > 0) process.exit(EXIT_NOT_VERIFIED);
+      if (notAssessed > 0 && !args.allowNotAssessed) process.exit(EXIT_NOT_ASSESSED);
     }
     return;
   }
   if (args.markdown) {
     write(markdownSummary(jsonResults, summary));
-    if (errors > 0) process.exit(1);
+    if (errors > 0) process.exit(EXIT_EXECUTION_ERROR);
     if (args.ci) {
-      if (notVerified > 0) process.exit(1);
-      if (notAssessed > 0 && !args.allowNotAssessed) process.exit(2);
+      if (notVerified > 0) process.exit(EXIT_NOT_VERIFIED);
+      if (notAssessed > 0 && !args.allowNotAssessed) process.exit(EXIT_NOT_ASSESSED);
     }
     return;
   }
@@ -410,21 +477,21 @@ ${c.gray}Saved CLI reports appear in your dashboard: https://aimodularity.com/ag
 ${c.gray}No dashboard report was saved. Check API key access and retry if you need dashboard sync.${c.reset}`);
   write(`${c.gray}A2SPA docs: ${A2SPA_DOCS_URL}${c.reset}
 `);
-  if (errors > 0) process.exit(1);
+  if (errors > 0) process.exit(EXIT_EXECUTION_ERROR);
   if (args.ci) {
-    if (notVerified > 0) process.exit(1);
-    if (notAssessed > 0 && !args.allowNotAssessed) process.exit(2);
+    if (notVerified > 0) process.exit(EXIT_NOT_VERIFIED);
+    if (notAssessed > 0 && !args.allowNotAssessed) process.exit(EXIT_NOT_ASSESSED);
   }
 }
 async function main() {
   const args = parseArgs(process.argv);
   if (args.version) {
     write(`agentverify v${VERSION}`);
-    process.exit(0);
+    process.exit(EXIT_OK);
   }
   if (args.help || !args.command) {
     printHelp();
-    process.exit(0);
+    process.exit(EXIT_OK);
   }
   if (args.command === "scan") {
     await runScan(args);
@@ -433,11 +500,11 @@ async function main() {
 ${c.red}Unknown command: ${args.command}${c.reset}`);
     console.error(`Run ${c.cyan}agentverify --help${c.reset} for usage
 `);
-    process.exit(1);
+    process.exit(EXIT_EXECUTION_ERROR);
   }
 }
 main().catch((err) => {
   console.error(`
 ${c.red}Fatal error:${c.reset}`, err instanceof Error ? err.message : err);
-  process.exit(1);
+  process.exit(EXIT_EXECUTION_ERROR);
 });

package/dist/cli.mjs

@@ -1,14 +1,18 @@
 #!/usr/bin/env node
 import {
   scan
-} from "./chunk-PY3NS2YH.mjs";
+} from "./chunk-XVA2M2HS.mjs";
 
 // src/cli.ts
-import { readFileSync, readdirSync, statSync } from "fs";
+import { readFileSync, readdirSync, statSync, appendFileSync, writeFileSync } from "fs";
 import { join, relative, extname } from "path";
-var VERSION = "1.3.0";
+var VERSION = "1.4.0";
 var API_URL = process.env.AGENTVERIFY_API_URL ?? "https://agentverify-api.agentverify.workers.dev/v1/scan";
 var A2SPA_DOCS_URL = "https://aimodularity.com/A2SPA/docs";
+var EXIT_OK = 0;
+var EXIT_NOT_VERIFIED = 1;
+var EXIT_NOT_ASSESSED = 2;
+var EXIT_EXECUTION_ERROR = 3;
 var c = {
   reset: "\x1B[0m",
   bold: "\x1B[1m",
@@ -23,6 +27,7 @@ var c = {
 var write = (value = "") => process.stdout.write(`${value}
 `);
 var SUPPORTED_EXTENSIONS = /* @__PURE__ */ new Set([".js", ".ts", ".py", ".json", ".yaml", ".yml", ".md", ".mjs", ".cjs"]);
+var MAX_SCAN_FILE_BYTES = 5 * 1024 * 1024;
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", ".next", "vendor", "coverage", ".cache"]);
 function collectFiles(dir) {
   const files = [];
@@ -54,7 +59,9 @@ function parseArgs(argv) {
     ci: false,
     allowNotAssessed: false,
     help: false,
-    version: false
+    version: false,
+    policy: "",
+    summaryFile: ""
   };
   if (result.command === "--help" || result.command === "-h") {
     result.command = "";
@@ -72,6 +79,8 @@ function parseArgs(argv) {
     else if (arg === "--markdown") result.markdown = true;
     else if (arg === "--ci") result.ci = true;
     else if (arg === "--allow-not-assessed") result.allowNotAssessed = true;
+    else if (arg === "--policy") result.policy = args[++i] ?? "";
+    else if (arg === "--summary-file") result.summaryFile = args[++i] ?? "";
     else if (arg === "--help" || arg === "-h") result.help = true;
     else if (arg === "--version" || arg === "-v") result.version = true;
     else if (!arg.startsWith("-")) result.dir = arg;
@@ -99,6 +108,10 @@ ${c.bold}Options:${c.reset}
   --ci          CI mode: concise output and non-zero exit for NOT VERIFIED
   --allow-not-assessed
                 In CI mode, do not fail only because content is NOT_ASSESSED
+  --policy <id> Evaluate a built-in policy profile against this scan's evidence
+                in addition to the scanner's own verdict (e.g. financial-agent)
+  --summary-file <path>
+                Write results as JSON to this path (in addition to any other output)
   --version, -v Print version
   --help, -h    Show this help message
 
@@ -118,6 +131,12 @@ ${c.bold}Examples:${c.reset}
   ${c.gray}# Markdown summary for pull requests${c.reset}
   agentverify scan . --key av_your_key --markdown
 
+${c.bold}Exit codes (--ci):${c.reset}
+  0   All scanned files verified
+  1   NOT VERIFIED \u2014 a security/verification check failed
+  2   NOT ASSESSED \u2014 insufficient evidence for a verdict (see --allow-not-assessed)
+  3   Execution error \u2014 the scan itself could not run (bad key, network, missing file)
+
 ${c.bold}Get your API key:${c.reset}
   https://aimodularity.com/agentverify/dashboard
 
@@ -139,6 +158,16 @@ function getFixFirst(result) {
 function getRelevantThreatCategories(result) {
   return (result.threatCategories ?? []).filter((item) => item.status !== "not_assessed").slice(0, 6).map((item) => `${item.label} (${item.status.replace("_", " ")})`);
 }
+function criticalCount(result) {
+  return result.findings.filter((f) => f.severity === "critical").length;
+}
+function highCount(result) {
+  return result.findings.filter((f) => f.severity === "high").length;
+}
+function fingerprintPreview(result) {
+  const hash = result.artifactFingerprint?.artifactHash;
+  return hash ? `${hash.slice(0, 12)}\u2026` : null;
+}
 function printDetailedSummary(result, fileName) {
   const verified = result.verdict === "VERIFIED";
   const verdictColor = verified ? c.green : result.verdict === "NOT_ASSESSED" ? c.yellow : c.red;
@@ -149,6 +178,10 @@ ${c.bold}${c.cyan}Agent Verify${c.reset}`);
   write(`${c.bold}Verdict:${c.reset} ${verdictColor}${result.verdict === "NOT_VERIFIED" ? "NOT VERIFIED" : result.verdict.replace("_", " ")}${c.reset}`);
   write(`${c.bold}Risk level:${c.reset} ${result.riskLevel}`);
   write(`${c.bold}Confidence:${c.reset} ${result.confidence}/100`);
+  write(`${c.bold}Critical / High findings:${c.reset} ${criticalCount(result)} / ${highCount(result)}`);
+  if (result.metadata?.scannerVersion) write(`${c.bold}Ruleset version:${c.reset} ${result.metadata.scannerVersion}`);
+  if (fingerprintPreview(result)) write(`${c.bold}Artifact fingerprint:${c.reset} ${fingerprintPreview(result)}`);
+  if (result.policyProfile) write(`${c.bold}Policy (${result.policyProfile}):${c.reset} ${result.policyResult === "PASS" ? `${c.green}PASS${c.reset}` : `${c.red}FAIL${c.reset}`}`);
   write(`${c.bold}Top blocker:${c.reset} ${getTopBlocker(result)}`);
   write(`
 ${c.bold}Fix first:${c.reset}`);
@@ -175,7 +208,11 @@ function markdownSummary(results, summary) {
       lines.push(`## ${item.file}`, "", `Error: ${item.error ?? "Unknown error"}`, "");
       continue;
     }
-    lines.push(`## ${item.file}`, "", `Score: ${item.result.riskScore}/100`, `Verdict: ${item.result.verdict === "NOT_VERIFIED" ? "NOT VERIFIED" : item.result.verdict.replace("_", " ")}`, `Risk level: ${item.result.riskLevel}`, `Top blocker: ${getTopBlocker(item.result)}`, "");
+    lines.push(`## ${item.file}`, "", `Score: ${item.result.riskScore}/100`, `Verdict: ${item.result.verdict === "NOT_VERIFIED" ? "NOT VERIFIED" : item.result.verdict.replace("_", " ")}`, `Risk level: ${item.result.riskLevel}`, `Critical / High findings: ${criticalCount(item.result)} / ${highCount(item.result)}`);
+    if (item.result.metadata?.scannerVersion) lines.push(`Ruleset version: ${item.result.metadata.scannerVersion}`);
+    if (fingerprintPreview(item.result)) lines.push(`Artifact fingerprint: \`${fingerprintPreview(item.result)}\``);
+    if (item.result.policyProfile) lines.push(`Policy (${item.result.policyProfile}): ${item.result.policyResult}`);
+    lines.push(`Top blocker: ${getTopBlocker(item.result)}`, "");
     const fixes = getFixFirst(item.result);
     if (fixes.length) lines.push("Fix first:", ...fixes.map((fix, index) => `${index + 1}. ${fix}`), "");
     const threats = getRelevantThreatCategories(item.result);
@@ -185,6 +222,24 @@ function markdownSummary(results, summary) {
   lines.push(`A2SPA docs: ${A2SPA_DOCS_URL}`);
   return lines.join("\n");
 }
+function writeGithubJobSummary(results, summary) {
+  const summaryPath = process.env.GITHUB_STEP_SUMMARY;
+  if (!summaryPath) return;
+  try {
+    appendFileSync(summaryPath, `${markdownSummary(results, summary)}
+`);
+  } catch (e) {
+    console.error(`Warning: could not write GitHub job summary: ${e instanceof Error ? e.message : e}`);
+  }
+}
+function writeSummaryFile(path, results, summary) {
+  if (!path) return;
+  try {
+    writeFileSync(path, JSON.stringify({ results, summary }, null, 2));
+  } catch (e) {
+    console.error(`Warning: could not write summary file: ${e instanceof Error ? e.message : e}`);
+  }
+}
 function printVerdict(result, fileName) {
   const verified = result.verdict === "VERIFIED";
   const notAssessed = result.verdict === "NOT_ASSESSED";
@@ -207,7 +262,7 @@ ${c.red}Error:${c.reset} API key required
     console.error(`  Get your key at https://aimodularity.com/agentverify/dashboard/`);
     console.error(`  Example: AGENTVERIFY_API_KEY=av_your_key agentverify scan .
 `);
-    process.exit(1);
+    process.exit(EXIT_EXECUTION_ERROR);
   }
   let files = [];
   if (args.file) {
@@ -238,10 +293,14 @@ ${c.bold}Agent Verify${c.reset} ${c.gray}v${VERSION}${c.reset}`);
     const batch = files.slice(i, i + CONCURRENCY);
     const batchResults = await Promise.allSettled(
       batch.map(async (filePath) => {
+        const fileStat = statSync(filePath);
+        if (fileStat.size > MAX_SCAN_FILE_BYTES) {
+          throw new Error(`File is ${(fileStat.size / 1024 / 1024).toFixed(1)}MB, over the ${MAX_SCAN_FILE_BYTES / 1024 / 1024}MB scan limit \u2014 skipped`);
+        }
         const content = readFileSync(filePath, "utf-8");
         const relPath = relative(args.dir === "." ? process.cwd() : args.dir, filePath);
         const result = await scan(
-          { content, fileName: relPath },
+          { content, fileName: relPath, policyId: args.policy || void 0 },
           { apiKey: args.key, apiUrl: API_URL }
         );
         return { filePath, relPath, result };
@@ -272,21 +331,23 @@ ${c.bold}Agent Verify${c.reset} ${c.gray}v${VERSION}${c.reset}`);
     }
   }
   const summary = { total: files.length, verified, notVerified, notAssessed, errors };
+  writeGithubJobSummary(jsonResults, summary);
+  writeSummaryFile(args.summaryFile, jsonResults, summary);
   if (args.json) {
     write(JSON.stringify({ results: jsonResults, summary }, null, 2));
-    if (errors > 0) process.exit(1);
+    if (errors > 0) process.exit(EXIT_EXECUTION_ERROR);
     if (args.ci) {
-      if (notVerified > 0) process.exit(1);
-      if (notAssessed > 0 && !args.allowNotAssessed) process.exit(2);
+      if (notVerified > 0) process.exit(EXIT_NOT_VERIFIED);
+      if (notAssessed > 0 && !args.allowNotAssessed) process.exit(EXIT_NOT_ASSESSED);
     }
     return;
   }
   if (args.markdown) {
     write(markdownSummary(jsonResults, summary));
-    if (errors > 0) process.exit(1);
+    if (errors > 0) process.exit(EXIT_EXECUTION_ERROR);
     if (args.ci) {
-      if (notVerified > 0) process.exit(1);
-      if (notAssessed > 0 && !args.allowNotAssessed) process.exit(2);
+      if (notVerified > 0) process.exit(EXIT_NOT_VERIFIED);
+      if (notAssessed > 0 && !args.allowNotAssessed) process.exit(EXIT_NOT_ASSESSED);
     }
     return;
   }
@@ -306,21 +367,21 @@ ${c.gray}Saved CLI reports appear in your dashboard: https://aimodularity.com/ag
 ${c.gray}No dashboard report was saved. Check API key access and retry if you need dashboard sync.${c.reset}`);
   write(`${c.gray}A2SPA docs: ${A2SPA_DOCS_URL}${c.reset}
 `);
-  if (errors > 0) process.exit(1);
+  if (errors > 0) process.exit(EXIT_EXECUTION_ERROR);
   if (args.ci) {
-    if (notVerified > 0) process.exit(1);
-    if (notAssessed > 0 && !args.allowNotAssessed) process.exit(2);
+    if (notVerified > 0) process.exit(EXIT_NOT_VERIFIED);
+    if (notAssessed > 0 && !args.allowNotAssessed) process.exit(EXIT_NOT_ASSESSED);
   }
 }
 async function main() {
   const args = parseArgs(process.argv);
   if (args.version) {
     write(`agentverify v${VERSION}`);
-    process.exit(0);
+    process.exit(EXIT_OK);
   }
   if (args.help || !args.command) {
     printHelp();
-    process.exit(0);
+    process.exit(EXIT_OK);
   }
   if (args.command === "scan") {
     await runScan(args);
@@ -329,11 +390,11 @@ async function main() {
 ${c.red}Unknown command: ${args.command}${c.reset}`);
     console.error(`Run ${c.cyan}agentverify --help${c.reset} for usage
 `);
-    process.exit(1);
+    process.exit(EXIT_EXECUTION_ERROR);
   }
 }
 main().catch((err) => {
   console.error(`
 ${c.red}Fatal error:${c.reset}`, err instanceof Error ? err.message : err);
-  process.exit(1);
+  process.exit(EXIT_EXECUTION_ERROR);
 });

package/dist/sdk.d.mts

@@ -2,6 +2,27 @@ interface ScanInput {
     content: string;
     fileName?: string;
     platform?: string;
+    /** One of the built-in policy profile ids (e.g. "financial-agent") — evaluated server-side against this scan's evidence, in addition to (never instead of) the scanner's own verdict. */
+    policyId?: string;
+}
+interface ArtifactFingerprint {
+    artifactHash: string;
+    artifactHashAlgorithm: string;
+    artifactFingerprintVersion: string;
+}
+interface ReportIntegrity {
+    reportHash: string;
+    algorithm: string;
+    schemaVersion: string;
+    scannerVersion: string;
+    scanId: string;
+    timestamp: string;
+}
+interface SignedAttestation {
+    payload: Record<string, unknown>;
+    signature: string;
+    algorithm: string;
+    publicKey: Record<string, unknown>;
 }
 type Verdict = 'VERIFIED' | 'NOT_VERIFIED' | 'NOT_ASSESSED';
 type RiskLevel = 'Low Risk' | 'Moderate Risk' | 'High Risk';
@@ -103,6 +124,11 @@ interface ScanResult {
     };
     saved: boolean;
     reportUrl?: string | null;
+    artifactFingerprint?: ArtifactFingerprint;
+    reportIntegrity?: ReportIntegrity;
+    policyProfile?: string | null;
+    policyResult?: string | null;
+    attestation?: SignedAttestation | null;
 }
 interface ScanOptions {
     apiKey: string;

package/dist/sdk.d.ts

@@ -2,6 +2,27 @@ interface ScanInput {
     content: string;
     fileName?: string;
     platform?: string;
+    /** One of the built-in policy profile ids (e.g. "financial-agent") — evaluated server-side against this scan's evidence, in addition to (never instead of) the scanner's own verdict. */
+    policyId?: string;
+}
+interface ArtifactFingerprint {
+    artifactHash: string;
+    artifactHashAlgorithm: string;
+    artifactFingerprintVersion: string;
+}
+interface ReportIntegrity {
+    reportHash: string;
+    algorithm: string;
+    schemaVersion: string;
+    scannerVersion: string;
+    scanId: string;
+    timestamp: string;
+}
+interface SignedAttestation {
+    payload: Record<string, unknown>;
+    signature: string;
+    algorithm: string;
+    publicKey: Record<string, unknown>;
 }
 type Verdict = 'VERIFIED' | 'NOT_VERIFIED' | 'NOT_ASSESSED';
 type RiskLevel = 'Low Risk' | 'Moderate Risk' | 'High Risk';
@@ -103,6 +124,11 @@ interface ScanResult {
     };
     saved: boolean;
     reportUrl?: string | null;
+    artifactFingerprint?: ArtifactFingerprint;
+    reportIntegrity?: ReportIntegrity;
+    policyProfile?: string | null;
+    policyResult?: string | null;
+    attestation?: SignedAttestation | null;
 }
 interface ScanOptions {
     apiKey: string;

package/dist/sdk.js

@@ -73,7 +73,12 @@ function normalizeScanResult(data) {
       scanDuration: 0
     },
     saved: data.saved === true,
-    reportUrl: data.reportUrl ?? null
+    reportUrl: data.reportUrl ?? null,
+    artifactFingerprint: data.artifactFingerprint,
+    reportIntegrity: data.reportIntegrity,
+    policyProfile: data.policyProfile ?? null,
+    policyResult: data.policyResult ?? null,
+    attestation: data.attestation ?? null
   };
 }
 async function scan(input, options) {
@@ -99,7 +104,8 @@ async function scan(input, options) {
       body: JSON.stringify({
         content: input.content,
         fileName: input.fileName ?? "agent",
-        platform: input.platform
+        platform: input.platform,
+        policyId: input.policyId
       }),
       signal: controller.signal
     });

package/dist/sdk.mjs

@@ -1,7 +1,7 @@
 import {
   scan,
   scanMany
-} from "./chunk-PY3NS2YH.mjs";
+} from "./chunk-XVA2M2HS.mjs";
 export {
   scan,
   scanMany

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "agentverify",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "CLI and SDK for Agent Verify — execution trust analysis for AI agents",
   "bin": {
-    "agentverify": "./dist/cli.js"
+    "agentverify": "dist/cli.js"
   },
   "main": "./dist/sdk.js",
   "module": "./dist/sdk.mjs",
@@ -16,7 +16,7 @@
     },
     "./cli": "./dist/cli.js"
   },
-  "files": ["dist", "README.md", "LICENSE"],
+  "files": ["dist", "README.md", "LICENSE", "CHANGELOG.md"],
   "scripts": {
     "build": "tsup src/cli.ts src/sdk.ts --format cjs,esm --dts --clean",
     "dev": "tsup src/cli.ts src/sdk.ts --format cjs,esm --dts --watch",