ai-trust 0.2.4 → 0.2.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md
CHANGED
|
@@ -1,5 +1,4 @@
|
|
|
1
|
-
> **[OpenA2A](https://github.com/opena2a-org/opena2a)**: [CLI](https://github.com/opena2a-org/opena2a) · [HackMyAgent](https://github.com/opena2a-org/hackmyagent) · [Secretless](https://github.com/opena2a-org/secretless-ai) · [AIM](https://github.com/opena2a-org/agent-identity-management) · [Browser Guard](https://github.com/opena2a-org/AI-BrowserGuard) · [DVAA](https://github.com/opena2a-org/damn-vulnerable-ai-agent)
|
|
2
|
-
|
|
1
|
+
> **[OpenA2A](https://github.com/opena2a-org/opena2a)**: [CLI](https://github.com/opena2a-org/opena2a) · [HackMyAgent](https://github.com/opena2a-org/hackmyagent) · [Secretless](https://github.com/opena2a-org/secretless-ai) · [AIM](https://github.com/opena2a-org/agent-identity-management) · [Browser Guard](https://github.com/opena2a-org/AI-BrowserGuard) · [DVAA](https://github.com/opena2a-org/damn-vulnerable-ai-agent)
|
|
3
2
|
# ai-trust
|
|
4
3
|
|
|
5
4
|
Trust verification CLI for AI packages. Queries the OpenA2A Registry trust graph for security scans, community consensus, dependency risk, and known advisories.
|
|
@@ -47,6 +46,8 @@ Expected output:
|
|
|
47
46
|
Findings: 0 critical, 0 high, 2 medium
|
|
48
47
|
```
|
|
49
48
|
|
|
49
|
+
|
|
50
|
+
|
|
50
51
|
## Built-in Help
|
|
51
52
|
|
|
52
53
|
```bash
|
|
@@ -198,8 +199,10 @@ See [docs/USE-CASES.md](docs/USE-CASES.md) for the full index.
|
|
|
198
199
|
|
|
199
200
|
## Links
|
|
200
201
|
|
|
201
|
-
- [OpenA2A](https://opena2a.org)
|
|
202
|
-
- [OpenA2A
|
|
202
|
+
- [OpenA2A Registry](https://registry.opena2a.org) — trust scores and scan data
|
|
203
|
+
- [OpenA2A CLI](https://github.com/opena2a-org/opena2a) — unified security CLI
|
|
204
|
+
- [HackMyAgent](https://github.com/opena2a-org/hackmyagent) — local scanning for unverified packages
|
|
205
|
+
- [opena2a.org](https://opena2a.org) — full platform
|
|
203
206
|
|
|
204
207
|
## License
|
|
205
208
|
|
|
@@ -1,9 +1,7 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* Community Contribution Module
|
|
3
3
|
*
|
|
4
|
-
*
|
|
5
|
-
* OpenA2A Registry. Compatible with @opena2a/contribute queue format:
|
|
6
|
-
* events queued by ai-trust are flushed by opena2a-cli, HMA, and vice versa.
|
|
4
|
+
* Delegates to @opena2a/contribute for queue management and batch submission.
|
|
7
5
|
*
|
|
8
6
|
* Queue file: ~/.opena2a/contribute-queue.json
|
|
9
7
|
* Endpoint: POST api.oa2a.org/api/v1/contribute
|
|
@@ -12,6 +10,7 @@
|
|
|
12
10
|
* severity counts, score, verdict). No file paths, no source code,
|
|
13
11
|
* no raw finding descriptions, no PII.
|
|
14
12
|
*/
|
|
13
|
+
import { getContributorToken, type ContributionEvent as SharedContributionEvent, type ContributionBatch as SharedContributionBatch } from "@opena2a/contribute";
|
|
15
14
|
import type { HmaFinding } from "../scanner/hma.js";
|
|
16
15
|
/** Anonymized finding sent to the registry. Only check ID, result, and severity. */
|
|
17
16
|
export interface ContributionFinding {
|
|
@@ -36,53 +35,29 @@ export interface ContributionResult {
|
|
|
36
35
|
scanId?: string;
|
|
37
36
|
error?: string;
|
|
38
37
|
}
|
|
39
|
-
/**
|
|
40
|
-
export
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
toolVersion: string;
|
|
44
|
-
timestamp: string;
|
|
45
|
-
package?: {
|
|
46
|
-
name: string;
|
|
47
|
-
version?: string;
|
|
48
|
-
ecosystem?: string;
|
|
49
|
-
};
|
|
50
|
-
scanSummary?: {
|
|
51
|
-
totalChecks: number;
|
|
52
|
-
passed: number;
|
|
53
|
-
critical: number;
|
|
54
|
-
high: number;
|
|
55
|
-
medium: number;
|
|
56
|
-
low: number;
|
|
57
|
-
score: number;
|
|
58
|
-
verdict: string;
|
|
59
|
-
durationMs: number;
|
|
60
|
-
};
|
|
61
|
-
}
|
|
62
|
-
/** Matches ContributionBatch from @opena2a/contribute/types. */
|
|
63
|
-
export interface ContributionBatch {
|
|
64
|
-
contributorToken: string;
|
|
65
|
-
events: ContributionEvent[];
|
|
66
|
-
submittedAt: string;
|
|
67
|
-
}
|
|
38
|
+
/** Re-export ContributionEvent from the shared library. */
|
|
39
|
+
export type ContributionEvent = SharedContributionEvent;
|
|
40
|
+
/** Re-export ContributionBatch from the shared library. */
|
|
41
|
+
export type ContributionBatch = SharedContributionBatch;
|
|
68
42
|
/**
|
|
69
43
|
* Generate a stable per-device contributor token.
|
|
70
|
-
*
|
|
71
|
-
*
|
|
72
|
-
* The salt is generated once on first call and persisted locally.
|
|
73
|
-
* Shared with hackmyagent so the same device gets the same token.
|
|
44
|
+
* Delegates to @opena2a/contribute. SHA256(hostname + username + random salt
|
|
45
|
+
* stored at ~/.opena2a/contributor-salt).
|
|
74
46
|
*/
|
|
75
|
-
export
|
|
47
|
+
export { getContributorToken as generateContributorToken };
|
|
76
48
|
/**
|
|
77
49
|
* Queue a scan result as a ContributionEvent.
|
|
78
50
|
*
|
|
79
|
-
*
|
|
80
|
-
*
|
|
51
|
+
* Delegates to @opena2a/contribute for queue management and batch
|
|
52
|
+
* submission. Converts the detailed finding list into an anonymized
|
|
53
|
+
* summary: only counts and severity distribution, no file paths or
|
|
54
|
+
* descriptions.
|
|
81
55
|
*/
|
|
82
56
|
export declare function queueScanResult(packageName: string, findings: HmaFinding[], durationMs?: number): void;
|
|
83
57
|
/**
|
|
84
58
|
* Flush queued events to the OpenA2A Registry.
|
|
85
59
|
* Returns true if submission succeeded (or queue was empty).
|
|
60
|
+
* Delegates to @opena2a/contribute.
|
|
86
61
|
*/
|
|
87
62
|
export declare function flushQueue(registryUrl?: string, verbose?: boolean): Promise<boolean>;
|
|
88
63
|
/**
|
|
@@ -91,10 +66,6 @@ export declare function flushQueue(registryUrl?: string, verbose?: boolean): Pro
|
|
|
91
66
|
* @deprecated Use queueScanResult() + flushQueue() instead. Kept for
|
|
92
67
|
* backward compatibility. The per-finding payload format is superseded
|
|
93
68
|
* by the summary-based ContributionEvent format.
|
|
94
|
-
*
|
|
95
|
-
* PRIVACY: This function intentionally strips all sensitive fields.
|
|
96
|
-
* The output contains ONLY: checkId, pass/fail result, and severity.
|
|
97
|
-
* No file paths, line numbers, descriptions, fix text, or code content.
|
|
98
69
|
*/
|
|
99
70
|
export declare function buildContributionPayload(packageName: string, findings: HmaFinding[]): ContributionPayload;
|
|
100
71
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"contribute.d.ts","sourceRoot":"","sources":["../../src/telemetry/contribute.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"contribute.d.ts","sourceRoot":"","sources":["../../src/telemetry/contribute.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAEL,mBAAmB,EAEnB,KAAK,iBAAiB,IAAI,uBAAuB,EACjD,KAAK,iBAAiB,IAAI,uBAAuB,EAClD,MAAM,qBAAqB,CAAC;AAG7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAUpD,oFAAoF;AACpF,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wEAAwE;AACxE,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;CACvC;AAED,2CAA2C;AAC3C,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,2DAA2D;AAC3D,MAAM,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAExD,2DAA2D;AAC3D,MAAM,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAMxD;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,IAAI,wBAAwB,EAAE,CAAC;AAiC3D;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,UAAU,EAAE,EACtB,UAAU,SAAI,GACb,IAAI,CA+BN;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAC9B,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,OAAO,CAAC,CAElB;AAMD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,UAAU,EAAE,GACrB,mBAAmB,CAiBrB;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,mBAAmB,EAC5B,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,kBAAkB,CAAC,CAyC7B"}
|
|
@@ -1,9 +1,7 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* Community Contribution Module
|
|
3
3
|
*
|
|
4
|
-
*
|
|
5
|
-
* OpenA2A Registry. Compatible with @opena2a/contribute queue format:
|
|
6
|
-
* events queued by ai-trust are flushed by opena2a-cli, HMA, and vice versa.
|
|
4
|
+
* Delegates to @opena2a/contribute for queue management and batch submission.
|
|
7
5
|
*
|
|
8
6
|
* Queue file: ~/.opena2a/contribute-queue.json
|
|
9
7
|
* Endpoint: POST api.oa2a.org/api/v1/contribute
|
|
@@ -12,58 +10,21 @@
|
|
|
12
10
|
* severity counts, score, verdict). No file paths, no source code,
|
|
13
11
|
* no raw finding descriptions, no PII.
|
|
14
12
|
*/
|
|
15
|
-
import {
|
|
16
|
-
import {
|
|
17
|
-
import { hostname, type as osType, userInfo } from "os";
|
|
18
|
-
import { join } from "path";
|
|
13
|
+
import { contribute, getContributorToken, queueEvent, } from "@opena2a/contribute";
|
|
14
|
+
import { type as osType } from "os";
|
|
19
15
|
import { createRequire } from "node:module";
|
|
20
16
|
const require = createRequire(import.meta.url);
|
|
21
17
|
const pkg = require("../../package.json");
|
|
22
18
|
const VERSION = pkg.version;
|
|
23
19
|
// ---------------------------------------------------------------------------
|
|
24
|
-
//
|
|
25
|
-
// ---------------------------------------------------------------------------
|
|
26
|
-
const REGISTRY_URL = "https://api.oa2a.org";
|
|
27
|
-
const FLUSH_THRESHOLD = 10;
|
|
28
|
-
const MAX_QUEUE_SIZE = 100;
|
|
29
|
-
const TIMEOUT_MS = 10_000;
|
|
30
|
-
/**
|
|
31
|
-
* Resolve the path to the OpenA2A home directory.
|
|
32
|
-
* Respects the OPENA2A_HOME env var, defaults to ~/.opena2a.
|
|
33
|
-
*/
|
|
34
|
-
function getOpena2aHome() {
|
|
35
|
-
return (process.env.OPENA2A_HOME || join(require("os").homedir(), ".opena2a"));
|
|
36
|
-
}
|
|
37
|
-
function ensureDir() {
|
|
38
|
-
const dir = getOpena2aHome();
|
|
39
|
-
if (!existsSync(dir))
|
|
40
|
-
mkdirSync(dir, { recursive: true });
|
|
41
|
-
}
|
|
42
|
-
// ---------------------------------------------------------------------------
|
|
43
|
-
// Contributor token (stable per-device, SHA256-hashed)
|
|
20
|
+
// Contributor token (delegated to @opena2a/contribute)
|
|
44
21
|
// ---------------------------------------------------------------------------
|
|
45
22
|
/**
|
|
46
23
|
* Generate a stable per-device contributor token.
|
|
47
|
-
*
|
|
48
|
-
*
|
|
49
|
-
* The salt is generated once on first call and persisted locally.
|
|
50
|
-
* Shared with hackmyagent so the same device gets the same token.
|
|
24
|
+
* Delegates to @opena2a/contribute. SHA256(hostname + username + random salt
|
|
25
|
+
* stored at ~/.opena2a/contributor-salt).
|
|
51
26
|
*/
|
|
52
|
-
export
|
|
53
|
-
const home = getOpena2aHome();
|
|
54
|
-
const saltPath = join(home, "contributor-salt");
|
|
55
|
-
let salt;
|
|
56
|
-
if (existsSync(saltPath)) {
|
|
57
|
-
salt = readFileSync(saltPath, "utf-8").trim();
|
|
58
|
-
}
|
|
59
|
-
else {
|
|
60
|
-
salt = randomBytes(32).toString("hex");
|
|
61
|
-
mkdirSync(home, { recursive: true });
|
|
62
|
-
writeFileSync(saltPath, salt, { mode: 0o600 });
|
|
63
|
-
}
|
|
64
|
-
const input = `${hostname()}|${userInfo().username}|${salt}`;
|
|
65
|
-
return createHash("sha256").update(input).digest("hex");
|
|
66
|
-
}
|
|
27
|
+
export { getContributorToken as generateContributorToken };
|
|
67
28
|
// ---------------------------------------------------------------------------
|
|
68
29
|
// OS type resolution
|
|
69
30
|
// ---------------------------------------------------------------------------
|
|
@@ -76,51 +37,6 @@ function resolveOsType() {
|
|
|
76
37
|
return "linux";
|
|
77
38
|
}
|
|
78
39
|
// ---------------------------------------------------------------------------
|
|
79
|
-
// Queue operations (compatible with @opena2a/contribute queue format)
|
|
80
|
-
// ---------------------------------------------------------------------------
|
|
81
|
-
function queuePath() {
|
|
82
|
-
return join(getOpena2aHome(), "contribute-queue.json");
|
|
83
|
-
}
|
|
84
|
-
function loadQueue() {
|
|
85
|
-
const path = queuePath();
|
|
86
|
-
if (!existsSync(path))
|
|
87
|
-
return { events: [] };
|
|
88
|
-
try {
|
|
89
|
-
return JSON.parse(readFileSync(path, "utf-8"));
|
|
90
|
-
}
|
|
91
|
-
catch {
|
|
92
|
-
return { events: [] };
|
|
93
|
-
}
|
|
94
|
-
}
|
|
95
|
-
function saveQueue(queue) {
|
|
96
|
-
ensureDir();
|
|
97
|
-
writeFileSync(queuePath(), JSON.stringify(queue), { mode: 0o600 });
|
|
98
|
-
}
|
|
99
|
-
function queueEvent(event) {
|
|
100
|
-
const queue = loadQueue();
|
|
101
|
-
queue.events.push(event);
|
|
102
|
-
if (queue.events.length > MAX_QUEUE_SIZE) {
|
|
103
|
-
queue.events = queue.events.slice(-MAX_QUEUE_SIZE);
|
|
104
|
-
}
|
|
105
|
-
saveQueue(queue);
|
|
106
|
-
}
|
|
107
|
-
function shouldFlush() {
|
|
108
|
-
return loadQueue().events.length >= FLUSH_THRESHOLD;
|
|
109
|
-
}
|
|
110
|
-
function buildBatch() {
|
|
111
|
-
const events = loadQueue().events;
|
|
112
|
-
if (events.length === 0)
|
|
113
|
-
return null;
|
|
114
|
-
return {
|
|
115
|
-
contributorToken: generateContributorToken(),
|
|
116
|
-
events,
|
|
117
|
-
submittedAt: new Date().toISOString(),
|
|
118
|
-
};
|
|
119
|
-
}
|
|
120
|
-
function clearQueue() {
|
|
121
|
-
saveQueue({ events: [] });
|
|
122
|
-
}
|
|
123
|
-
// ---------------------------------------------------------------------------
|
|
124
40
|
// Verdict computation
|
|
125
41
|
// ---------------------------------------------------------------------------
|
|
126
42
|
function computeVerdict(findings) {
|
|
@@ -133,76 +49,53 @@ function computeVerdict(findings) {
|
|
|
133
49
|
return "pass";
|
|
134
50
|
}
|
|
135
51
|
// ---------------------------------------------------------------------------
|
|
136
|
-
//
|
|
52
|
+
// Queue a scan result (delegates to @opena2a/contribute)
|
|
137
53
|
// ---------------------------------------------------------------------------
|
|
138
54
|
/**
|
|
139
55
|
* Queue a scan result as a ContributionEvent.
|
|
140
56
|
*
|
|
141
|
-
*
|
|
142
|
-
*
|
|
57
|
+
* Delegates to @opena2a/contribute for queue management and batch
|
|
58
|
+
* submission. Converts the detailed finding list into an anonymized
|
|
59
|
+
* summary: only counts and severity distribution, no file paths or
|
|
60
|
+
* descriptions.
|
|
143
61
|
*/
|
|
144
62
|
export function queueScanResult(packageName, findings, durationMs = 0) {
|
|
145
63
|
const total = findings.length;
|
|
146
64
|
const passed = findings.filter((f) => f.passed).length;
|
|
147
65
|
const failed = findings.filter((f) => !f.passed);
|
|
148
|
-
const
|
|
149
|
-
|
|
66
|
+
const critical = failed.filter((f) => f.severity === "critical").length;
|
|
67
|
+
const high = failed.filter((f) => f.severity === "high").length;
|
|
68
|
+
const medium = failed.filter((f) => f.severity === "medium").length;
|
|
69
|
+
const low = failed.filter((f) => f.severity === "low").length;
|
|
70
|
+
const score = total > 0 ? Math.round((passed / total) * 100) : 0;
|
|
71
|
+
const verdict = computeVerdict(findings);
|
|
72
|
+
// Delegate to @opena2a/contribute -- fire-and-forget since the
|
|
73
|
+
// shared library handles queue persistence internally.
|
|
74
|
+
contribute.scanResult({
|
|
150
75
|
tool: "ai-trust",
|
|
151
76
|
toolVersion: VERSION,
|
|
152
|
-
|
|
153
|
-
|
|
154
|
-
|
|
155
|
-
|
|
156
|
-
|
|
157
|
-
|
|
158
|
-
|
|
159
|
-
|
|
160
|
-
|
|
161
|
-
|
|
162
|
-
|
|
163
|
-
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
durationMs,
|
|
167
|
-
},
|
|
168
|
-
};
|
|
169
|
-
queueEvent(event);
|
|
77
|
+
packageName,
|
|
78
|
+
ecosystem: "npm",
|
|
79
|
+
totalChecks: total,
|
|
80
|
+
passed,
|
|
81
|
+
critical,
|
|
82
|
+
high,
|
|
83
|
+
medium,
|
|
84
|
+
low,
|
|
85
|
+
score,
|
|
86
|
+
verdict,
|
|
87
|
+
durationMs,
|
|
88
|
+
}).catch(() => {
|
|
89
|
+
// Non-fatal: contribution should never crash the scan
|
|
90
|
+
});
|
|
170
91
|
}
|
|
171
92
|
/**
|
|
172
93
|
* Flush queued events to the OpenA2A Registry.
|
|
173
94
|
* Returns true if submission succeeded (or queue was empty).
|
|
95
|
+
* Delegates to @opena2a/contribute.
|
|
174
96
|
*/
|
|
175
97
|
export async function flushQueue(registryUrl, verbose) {
|
|
176
|
-
|
|
177
|
-
if (!batch)
|
|
178
|
-
return true;
|
|
179
|
-
const url = `${(registryUrl || REGISTRY_URL).replace(/\/+$/, "")}/api/v1/contribute`;
|
|
180
|
-
try {
|
|
181
|
-
const controller = new AbortController();
|
|
182
|
-
const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
|
|
183
|
-
const response = await fetch(url, {
|
|
184
|
-
method: "POST",
|
|
185
|
-
headers: {
|
|
186
|
-
"Content-Type": "application/json",
|
|
187
|
-
"User-Agent": `ai-trust/${VERSION}`,
|
|
188
|
-
},
|
|
189
|
-
body: JSON.stringify(batch),
|
|
190
|
-
signal: controller.signal,
|
|
191
|
-
});
|
|
192
|
-
clearTimeout(timer);
|
|
193
|
-
if (response.ok) {
|
|
194
|
-
clearQueue();
|
|
195
|
-
if (verbose) {
|
|
196
|
-
process.stderr.write(` Shared: anonymized results for ${batch.events.length} scan(s) (community trust)\n`);
|
|
197
|
-
}
|
|
198
|
-
return true;
|
|
199
|
-
}
|
|
200
|
-
return false;
|
|
201
|
-
}
|
|
202
|
-
catch {
|
|
203
|
-
// Offline or unreachable -- events stay in queue for next time
|
|
204
|
-
return false;
|
|
205
|
-
}
|
|
98
|
+
return contribute.flush(registryUrl, verbose);
|
|
206
99
|
}
|
|
207
100
|
// ---------------------------------------------------------------------------
|
|
208
101
|
// Legacy API (kept for backward compatibility with existing callers/tests)
|
|
@@ -213,10 +106,6 @@ export async function flushQueue(registryUrl, verbose) {
|
|
|
213
106
|
* @deprecated Use queueScanResult() + flushQueue() instead. Kept for
|
|
214
107
|
* backward compatibility. The per-finding payload format is superseded
|
|
215
108
|
* by the summary-based ContributionEvent format.
|
|
216
|
-
*
|
|
217
|
-
* PRIVACY: This function intentionally strips all sensitive fields.
|
|
218
|
-
* The output contains ONLY: checkId, pass/fail result, and severity.
|
|
219
|
-
* No file paths, line numbers, descriptions, fix text, or code content.
|
|
220
109
|
*/
|
|
221
110
|
export function buildContributionPayload(packageName, findings) {
|
|
222
111
|
const contributionFindings = findings.map((f) => ({
|
|
@@ -225,7 +114,7 @@ export function buildContributionPayload(packageName, findings) {
|
|
|
225
114
|
severity: f.severity,
|
|
226
115
|
}));
|
|
227
116
|
return {
|
|
228
|
-
contributorToken:
|
|
117
|
+
contributorToken: getContributorToken(),
|
|
229
118
|
packageName,
|
|
230
119
|
packageVersion: "",
|
|
231
120
|
ecosystem: "npm",
|
|
@@ -243,7 +132,6 @@ export function buildContributionPayload(packageName, findings) {
|
|
|
243
132
|
* posting per-finding payloads directly.
|
|
244
133
|
*/
|
|
245
134
|
export async function submitContribution(payload, registryUrl) {
|
|
246
|
-
// Convert legacy payload into a queue event and flush
|
|
247
135
|
const event = {
|
|
248
136
|
type: "scan_result",
|
|
249
137
|
tool: "ai-trust",
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"contribute.js","sourceRoot":"","sources":["../../src/telemetry/contribute.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"contribute.js","sourceRoot":"","sources":["../../src/telemetry/contribute.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,UAAU,GAGX,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG5C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAC1C,MAAM,OAAO,GAAW,GAAG,CAAC,OAAO,CAAC;AAsCpC,8EAA8E;AAC9E,uDAAuD;AACvD,8EAA8E;AAE9E;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,IAAI,wBAAwB,EAAE,CAAC;AAE3D,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,SAAS,aAAa;IACpB,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;IACnB,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IACnC,IAAI,CAAC,KAAK,YAAY;QAAE,OAAO,SAAS,CAAC;IACzC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,SAAS,cAAc,CAAC,QAAsB;IAC5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,CAC9C,CAAC,MAAM,CAAC;IACT,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAC1B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAC1C,CAAC,MAAM,CAAC;IACT,IAAI,QAAQ,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,yDAAyD;AACzD,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,WAAmB,EACnB,QAAsB,EACtB,UAAU,GAAG,CAAC;IAEd,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC9B,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACvD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAEjD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IACpE,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC;IAC9D,MAAM,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAEzC,+DAA+D;IAC/D,uDAAuD;IACvD,UAAU,CAAC,UAAU,CAAC;QACpB,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,OAAO;QACpB,WAAW;QACX,SAAS,EAAE,KAAK;QAChB,WAAW,EAAE,KAAK;QAClB,MAAM;QACN,QAAQ;QACR,IAAI;QACJ,MAAM;QACN,GAAG;QACH,KAAK;QACL,OAAO;QACP,UAAU;KACX,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QACZ,sDAAsD;IACxD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,WAAoB,EACpB,OAAiB;IAEjB,OAAO,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED,8EAA8E;AAC9E,2EAA2E;AAC3E,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,WAAmB,EACnB,QAAsB;IAEtB,MAAM,oBAAoB,GAA0B,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,MAAgB,CAAC,CAAC,CAAE,MAAgB;QACxD,QAAQ,EAAE,CAAC,CAAC,QAAQ;KACrB,CAAC,CAAC,CAAC;IAEJ,OAAO;QACL,gBAAgB,EAAE,mBAAmB,EAAE;QACvC,WAAW;QACX,cAAc,EAAE,EAAE;QAClB,SAAS,EAAE,KAAK;QAChB,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACvC,QAAQ,EAAE,oBAAoB;QAC9B,cAAc,EAAE,OAAO;QACvB,MAAM,EAAE,aAAa,EAAE;KACxB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA4B,EAC5B,WAAoB;IAEpB,MAAM,KAAK,GAAsB;QAC/B,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,OAAO,CAAC,cAAc;QACnC,SAAS,EAAE,OAAO,CAAC,aAAa;QAChC,OAAO,EAAE;YACP,IAAI,EAAE,OAAO,CAAC,WAAW;YACzB,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B;QACD,WAAW,EAAE;YACX,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;YACpC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM;YAClE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,CACxD,CAAC,MAAM;YACR,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CACpD,CAAC,MAAM;YACR,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CACtD,CAAC,MAAM;YACR,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAC1B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK,CACnD,CAAC,MAAM;YACR,KAAK,EACH,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;gBACzB,CAAC,CAAC,IAAI,CAAC,KAAK,CACR,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM;oBACzD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACxB,GAAG,CACN;gBACH,CAAC,CAAC,CAAC;YACP,OAAO,EAAE,MAAM;YACf,UAAU,EAAE,CAAC;SACd;KACF,CAAC;IAEF,UAAU,CAAC,KAAK,CAAC,CAAC;IAClB,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC;IACzC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AACzB,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "ai-trust",
|
|
3
|
-
"version": "0.2.
|
|
3
|
+
"version": "0.2.5",
|
|
4
4
|
"description": "Trust verification CLI for AI packages — check MCP servers, A2A agents, and AI tools before you install",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
@@ -37,6 +37,7 @@
|
|
|
37
37
|
"author": "OpenA2A",
|
|
38
38
|
"license": "Apache-2.0",
|
|
39
39
|
"dependencies": {
|
|
40
|
+
"@opena2a/contribute": "^0.1.0",
|
|
40
41
|
"@opena2a/shared": "^0.1.0",
|
|
41
42
|
"chalk": "^5.3.0",
|
|
42
43
|
"commander": "^12.1.0"
|