agentverify 1.3.0 → 1.6.0

package/CHANGELOG.md

@@ -0,0 +1,48 @@
+# Changelog
+
+All notable changes to the `agentverify` CLI/SDK package are documented here.
+
+## [1.6.0] - 2026-10-27
+
+### Added
+
+- Scans now run Agent Verify's v1.6 check set (76 checks, up from 44), including framework packs
+  and MCP configuration checks — no CLI change needed;
+  results come from the API. See the root CHANGELOG for the full list.
+- Directory scans now also pick up `.jsx`, `.tsx`, `.toml`, and `.sh` files.
+
+## [1.5.0] - 2026-09-22
+
+### Added
+
+- `--profile <id>` — assess a directory against an assessment profile instead of running the
+  standard scan/verify flow. `owasp-agentic-skills-2026` is the first supported profile
+  (assessment schema `1.1.0`, currently alpha): `agentverify scan <dir> --profile owasp-agentic-skills-2026 --key av_your_key`.
+  Prints AST02/AST03/AST04 evidence-based results (`EVIDENCE_OBSERVED` / `GAP_IDENTIFIED`) plus
+  every other control explicitly as `NOT_ASSESSED`; `--json` prints the service's response
+  unmodified.
+
+## [1.4.0] - Shipped
+
+### Changed — CI exit codes now distinguish a security failure from an execution error (behavior change)
+
+Previously, `--ci` mode used exit code `1` for **both** a real `NOT_VERIFIED` verdict **and** any execution error (missing/invalid API key, network failure, missing file). That made it impossible for a pipeline to tell "the agent failed the security check" apart from "the scan itself couldn't run."
+
+New exit codes:
+
+| Code | Meaning | Previously |
+| --- | --- | --- |
+| `0` | All scanned files verified | `0` (unchanged) |
+| `1` | `NOT_VERIFIED` — a real security/verification failure | `1` (unchanged) |
+| `2` | `NOT_ASSESSED` — insufficient evidence for a verdict | `2` (unchanged) |
+| `3` | **New.** Execution error — bad/missing API key, network failure, missing file, unknown command | was `1` |
+
+**If your pipeline only checks `exit code != 0` to block a deployment, this is not a breaking change** — every previously-non-zero case is still non-zero. **If your pipeline branches on the exact code `1`**, an execution error will now surface as `3` instead — update any such logic to treat both `1` and `3` as failures, or to react differently to `3` (an infrastructure problem, not a security finding).
+
+### Fixed
+
+- Scanner: findings that reference a detected credential no longer include the live secret value in `evidence` — only a redacted preview (e.g. `api_key: "sk_l****" (redacted)`). Affects report evidence produced by any scan, including those made public via report sharing.
+
+## [1.3.0] - 2026-07-13
+
+Initial public release. See git history for prior changes.

package/README.md

@@ -51,6 +51,17 @@ agentverify scan ./agents --ci
 
 Normal scans print findings without failing the shell just because issues exist. CI mode is stricter: it exits non-zero when an agent is `NOT_VERIFIED`, when a scan errors, or when submitted content cannot be assessed.
 
+Exit codes distinguish a security/verification result from an application error, so a pipeline can tell "the agent failed the check" apart from "the scan itself couldn't run":
+
+| Code | Meaning |
+| --- | --- |
+| `0` | All scanned files verified |
+| `1` | `NOT_VERIFIED` — a security/verification check failed |
+| `2` | `NOT_ASSESSED` — insufficient evidence for a verdict (see `--allow-not-assessed`) |
+| `3` | Execution error — the scan itself could not run (bad key, network failure, missing file) |
+
+All non-zero codes still fail a pipeline step by default, so an existing `if [ $? -ne 0 ]`-style check keeps working unchanged.
+
 ## SDK Usage
 
 ```ts
@@ -105,7 +116,7 @@ The workflow requires a valid `AGENTVERIFY_API_KEY`. The local Worker code path
 
 Saved CLI reports sync to the dashboard through the API `cliReports` save path. If the API cannot save the report, the CLI still prints local scan output and tells you dashboard sync did not complete.
 
-Verified reports can expose a README badge from the report page. A packaged Agent Verify GitHub Action with automatic PR comments is planned after the v1.3.0 app/CLI release candidate stabilizes.
+Verified reports can expose a README badge from the report page. A packaged Agent Verify GitHub Action (`AI-Blockchain-Ventures/agentverify@v1.4.0`) already exists and produces text/Markdown/JSON output plus an optional workflow artifact — see below. Automatically posting that output as a PR comment (rather than just producing it for you to post) is still a planned enhancement, not yet built.
 
 See the full GitHub Action guide at `docs/github-action.md` for composite action inputs, JSON/Markdown examples, branch protection, optional PR comments, and badge guidance.
 

package/dist/{chunk-PY3NS2YH.mjs → chunk-XVA2M2HS.mjs}

@@ -48,7 +48,12 @@ function normalizeScanResult(data) {
       scanDuration: 0
     },
     saved: data.saved === true,
-    reportUrl: data.reportUrl ?? null
+    reportUrl: data.reportUrl ?? null,
+    artifactFingerprint: data.artifactFingerprint,
+    reportIntegrity: data.reportIntegrity,
+    policyProfile: data.policyProfile ?? null,
+    policyResult: data.policyResult ?? null,
+    attestation: data.attestation ?? null
   };
 }
 async function scan(input, options) {
@@ -74,7 +79,8 @@ async function scan(input, options) {
       body: JSON.stringify({
         content: input.content,
         fileName: input.fileName ?? "agent",
-        platform: input.platform
+        platform: input.platform,
+        policyId: input.policyId
       }),
       signal: controller.signal
     });