hackmyagent 0.14.1 → 0.15.0

package/dist/hardening/scanner.d.ts

@@ -2,7 +2,7 @@
  * Hardening Scanner
  * Scans for security issues and optionally auto-fixes them
  */
-import type { ScanResult } from './security-check';
+import type { ScanResult, SecurityFinding, ProjectType } from './security-check';
 /** Scan depth for CAAT tiered scanning */
 export type ScanDepth = 'quick' | 'standard' | 'deep';
 export interface ScanOptions {
@@ -36,9 +36,20 @@ export declare class HardeningScanner {
      */
     private isPathWithinDirectory;
     /**
-     * Load .hmaignore file from target directory. Returns list of path prefixes to exclude.
+     * Load .hmaignore file from target directory.
+     * Returns path patterns (plain lines) and check ID suppression patterns (lines starting with !).
      */
     private loadHmaIgnore;
+    /**
+     * Check if a check ID matches any suppression pattern from .hmaignore.
+     * Supports exact match and wildcard (*) at the end (e.g. SANDBOX-* matches SANDBOX-001).
+     */
+    private isCheckIdSuppressed;
+    /**
+     * Re-apply .hmaignore filters to a set of findings.
+     * Call this after NanoMind merge overwrites result.findings with unfiltered data.
+     */
+    reapplyIgnoreFilters(findings: SecurityFinding[], targetDir: string, additionalIgnorePaths?: string[]): Promise<SecurityFinding[]>;
     /**
      * Check if a file path matches any .hmaignore pattern.
      */
@@ -52,7 +63,7 @@ export declare class HardeningScanner {
     /**
      * Check if a finding applies to the given project type
      */
-    private findingAppliesTo;
+    findingAppliesTo(finding: SecurityFinding, projectType: ProjectType): boolean;
     private checkCredentialExposure;
     private checkClaudeMd;
     private checkMcpConfig;
@@ -108,7 +119,10 @@ export declare class HardeningScanner {
      * MCP tool permission boundary checks
      */
     private checkToolBoundaries;
-    private calculateScore;
+    calculateScore(findings: SecurityFinding[]): {
+        score: number;
+        maxScore: number;
+    };
     /**
      * Create a backup of files that may be modified during auto-fix
      */

package/dist/hardening/scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../src/hardening/scanner.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EAAE,UAAU,EAA0C,MAAM,kBAAkB,CAAC;AA4G3F,0CAA0C;AAC1C,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;AAEtD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,oDAAoD;IACpD,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAoID,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,OAAO,CAAiB;IAEhC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CA2BlC;IAEF;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAM7B;;OAEG;YACW,aAAa;IAa3B;;OAEG;IACH,OAAO,CAAC,aAAa;IASf,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;YAsZvC,cAAc;IAwE5B;;OAEG;YACW,iBAAiB;IA+F/B;;OAEG;IACH,OAAO,CAAC,gBAAgB;YAeV,uBAAuB;YA4GvB,aAAa;YAiDb,cAAc;YAiGd,oBAAoB;YAyDpB,gBAAgB;YAgJhB,oBAAoB;YAkFpB,gBAAgB;YA8IhB,mBAAmB;YA8EnB,iBAAiB;YA0CjB,iBAAiB;YAiEjB,wBAAwB;YA6FxB,wBAAwB;YAqExB,wBAAwB;YAyHxB,oBAAoB;YAmHpB,uBAAuB;YA4IvB,iBAAiB;YAkHjB,oBAAoB;YA0HpB,mBAAmB;YAqGnB,gBAAgB;YAwIhB,oBAAoB;YAwIpB,gBAAgB;YA6HhB,qBAAqB;YAmHrB,eAAe;IAqI7B;;OAEG;YACW,mBAAmB;IAkHjC;;OAEG;YACW,oBAAoB;IAqKlC;;OAEG;YACW,iBAAiB;IAgJ/B;;OAEG;YACW,oBAAoB;IA4IlC;;OAEG;YACW,eAAe;IAyJ7B;;OAEG;YACW,eAAe;IA2I7B;;OAEG;YACW,eAAe;IA6G7B;;OAEG;YACW,mBAAmB;IAuHjC,OAAO,CAAC,cAAc;IAsBtB;;OAEG;YACW,YAAY;IAmE1B;;OAEG;IACG,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA6DhD;;;OAGG;YACW,cAAc;IAgD5B;;OAEG;YACW,mBAAmB;IA6pBjC;;;OAGG;YACW,kBAAkB;IAgDhC;;OAEG;YACW,sBAAsB;IAkMpC;;OAEG;YACW,sBAAsB;IA+BpC;;OAEG;YACW,oBAAoB;IAgWlC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA4B3B;;OAEG;YACW,iBAAiB;IA8D/B;;OAEG;YACW,mBAAmB;IAsXjC;;OAEG;YACW,wBAAwB;IAqPtC;;OAEG;YACW,gBAAgB;IAoK9B;;;OAGG;YACW,eAAe;IAoD7B;;;OAGG;YACW,aAAa;IAwC3B;;;OAGG;YACW,oBAAoB;IAoKlC;;;OAGG;YACW,iBAAiB;IAiI/B;;;OAGG;YACW,kBAAkB;IAkFhC;;;OAGG;YACW,aAAa;IA0F3B;;OAEG;YACW,gBAAgB;IAiE9B;;;;OAIG;YACW,yBAAyB;IA0WvC;;;;;OAKG;YACW,qBAAqB;IAqnBnC;;;;OAIG;YACW,gBAAgB;IA2G9B;;;;OAIG;YACW,mBAAmB;IAmKjC;;;;OAIG;YACW,gBAAgB;IAkF9B;;;OAGG;YACW,iBAAiB;IA+C/B;;;;OAIG;YACW,yBAAyB;IA6FvC;;;OAGG;YACW,kBAAkB;IA8ChC;;;OAGG;YACW,mBAAmB;IA4CjC;;;OAGG;YACW,6BAA6B;IAiD3C;;;OAGG;YACW,oBAAoB;IA4ClC;;;OAGG;YACW,WAAW;IA4DzB;;;OAGG;YACW,aAAa;IAgD3B;;;OAGG;YACW,oBAAoB;IA6ClC;;;OAGG;YACW,YAAY;IAmD1B;;;OAGG;YACW,qBAAqB;IA+DnC;;;;OAIG;YACW,oBAAoB;IAyHlC;;;OAGG;YACW,iBAAiB;IA+F/B;;;OAGG;YACW,4BAA4B;IAqD1C;;;OAGG;YACW,8BAA8B;IAgE5C;;;;OAIG;YACW,qBAAqB;IAgBnC,+DAA+D;YACjD,YAAY;CA+B3B"}
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../src/hardening/scanner.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAY,WAAW,EAAE,MAAM,kBAAkB,CAAC;AA4G3F,0CAA0C;AAC1C,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;AAEtD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,oDAAoD;IACpD,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAoID,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,OAAO,CAAiB;IAEhC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CA2BlC;IAEF;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAM7B;;;OAGG;YACW,aAAa;IAwB3B;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAa3B;;;OAGG;IACG,oBAAoB,CACxB,QAAQ,EAAE,eAAe,EAAE,EAC3B,SAAS,EAAE,MAAM,EACjB,qBAAqB,CAAC,EAAE,MAAM,EAAE,GAC/B,OAAO,CAAC,eAAe,EAAE,CAAC;IAgB7B;;OAEG;IACH,OAAO,CAAC,aAAa;IASf,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;YA+ZvC,cAAc;IAwE5B;;OAEG;YACW,iBAAiB;IA+F/B;;OAEG;IACH,gBAAgB,CAAC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,GAAG,OAAO;YAe/D,uBAAuB;YA4GvB,aAAa;YAiDb,cAAc;YAiGd,oBAAoB;YAyDpB,gBAAgB;YAgJhB,oBAAoB;YAkFpB,gBAAgB;YA8IhB,mBAAmB;YA8EnB,iBAAiB;YA0CjB,iBAAiB;YAiEjB,wBAAwB;YA6FxB,wBAAwB;YAqExB,wBAAwB;YAyHxB,oBAAoB;YAmHpB,uBAAuB;YA4IvB,iBAAiB;YAkHjB,oBAAoB;YA0HpB,mBAAmB;YAqGnB,gBAAgB;YAwIhB,oBAAoB;YAwIpB,gBAAgB;YA6HhB,qBAAqB;YAmHrB,eAAe;IAqI7B;;OAEG;YACW,mBAAmB;IAkHjC;;OAEG;YACW,oBAAoB;IAqKlC;;OAEG;YACW,iBAAiB;IAgJ/B;;OAEG;YACW,oBAAoB;IA4IlC;;OAEG;YACW,eAAe;IAyJ7B;;OAEG;YACW,eAAe;IA2I7B;;OAEG;YACW,eAAe;IA6G7B;;OAEG;YACW,mBAAmB;IAuHjC,cAAc,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG;QAC3C,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;KAClB;IAmBD;;OAEG;YACW,YAAY;IAmE1B;;OAEG;IACG,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA6DhD;;;OAGG;YACW,cAAc;IAgD5B;;OAEG;YACW,mBAAmB;IA6pBjC;;;OAGG;YACW,kBAAkB;IAgDhC;;OAEG;YACW,sBAAsB;IAkMpC;;OAEG;YACW,sBAAsB;IA+BpC;;OAEG;YACW,oBAAoB;IAgWlC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA4B3B;;OAEG;YACW,iBAAiB;IA8D/B;;OAEG;YACW,mBAAmB;IAsXjC;;OAEG;YACW,wBAAwB;IAqPtC;;OAEG;YACW,gBAAgB;IAoK9B;;;OAGG;YACW,eAAe;IAoD7B;;;OAGG;YACW,aAAa;IAwC3B;;;OAGG;YACW,oBAAoB;IAoKlC;;;OAGG;YACW,iBAAiB;IAiI/B;;;OAGG;YACW,kBAAkB;IAkFhC;;;OAGG;YACW,aAAa;IA0F3B;;OAEG;YACW,gBAAgB;IAiE9B;;;;OAIG;YACW,yBAAyB;IA0WvC;;;;;OAKG;YACW,qBAAqB;IAqnBnC;;;;OAIG;YACW,gBAAgB;IA2G9B;;;;OAIG;YACW,mBAAmB;IAmKjC;;;;OAIG;YACW,gBAAgB;IAkF9B;;;OAGG;YACW,iBAAiB;IA+C/B;;;;OAIG;YACW,yBAAyB;IA6FvC;;;OAGG;YACW,kBAAkB;IA8ChC;;;OAGG;YACW,mBAAmB;IA4CjC;;;OAGG;YACW,6BAA6B;IAiD3C;;;OAGG;YACW,oBAAoB;IA4ClC;;;OAGG;YACW,WAAW;IA4DzB;;;OAGG;YACW,aAAa;IAgD3B;;;OAGG;YACW,oBAAoB;IA6ClC;;;OAGG;YACW,YAAY;IAmD1B;;;OAGG;YACW,qBAAqB;IA+DnC;;;;OAIG;YACW,oBAAoB;IAyHlC;;;OAGG;YACW,iBAAiB;IA+F/B;;;OAGG;YACW,4BAA4B;IAqD1C;;;OAGG;YACW,8BAA8B;IAgE5C;;;;OAIG;YACW,qBAAqB;IAgBnC,+DAA+D;YACjD,YAAY;CA+B3B"}

package/dist/hardening/scanner.js

@@ -71,12 +71,12 @@ const CHECK_PROJECT_TYPES = {
     'SESSION-': ['webapp', 'api'], // Session management
     'NET-': ['webapp', 'api'], // Network security (HTTPS, etc.)
     'IO-': ['webapp', 'api'], // Input/output (XSS, etc.)
-    // OpenClaw-specific checks
-    'SKILL-': ['openclaw', 'mcp'], // Skill file security
-    'HEARTBEAT-': ['openclaw'], // Heartbeat/periodic task security
+    // Skill/config checks - apply to all because if these files exist, they matter
+    'SKILL-': ['all'], // Skill file security (fires only when skill files exist)
+    'HEARTBEAT-': ['all'], // Heartbeat/periodic task security (fires only when HEARTBEAT.md exists)
     'GATEWAY-': ['openclaw'], // Gateway configuration security
-    'CONFIG-': ['openclaw', 'mcp'], // Configuration file security
-    'SUPPLY-': ['openclaw', 'mcp'], // Supply chain security
+    'CONFIG-': ['all'], // Configuration file security (fires only when config files exist)
+    'SUPPLY-': ['all'], // Supply chain security (fires only when skill files exist)
     'CVE-': ['openclaw'], // CVE-specific detection
     'API-': ['api'], // API security headers
     'RATE-': ['webapp', 'api'], // Rate limiting
@@ -259,21 +259,70 @@ class HardeningScanner {
         return normalizedFile.startsWith(normalizedDir + path.sep) || normalizedFile === normalizedDir;
     }
     /**
-     * Load .hmaignore file from target directory. Returns list of path prefixes to exclude.
+     * Load .hmaignore file from target directory.
+     * Returns path patterns (plain lines) and check ID suppression patterns (lines starting with !).
      */
     async loadHmaIgnore(targetDir) {
         const ignorePath = path.join(targetDir, '.hmaignore');
         try {
             const content = await fs.readFile(ignorePath, 'utf-8');
-            return content
+            const lines = content
                 .split('\n')
                 .map(line => line.trim())
                 .filter(line => line && !line.startsWith('#'));
+            const paths = [];
+            const checkIds = [];
+            for (const line of lines) {
+                if (line.startsWith('!')) {
+                    // Check ID suppression pattern: strip the ! prefix, store uppercase
+                    checkIds.push(line.slice(1).toUpperCase());
+                }
+                else {
+                    paths.push(line);
+                }
+            }
+            return { paths, checkIds };
         }
         catch {
-            return [];
+            return { paths: [], checkIds: [] };
         }
     }
+    /**
+     * Check if a check ID matches any suppression pattern from .hmaignore.
+     * Supports exact match and wildcard (*) at the end (e.g. SANDBOX-* matches SANDBOX-001).
+     */
+    isCheckIdSuppressed(checkId, patterns) {
+        if (patterns.length === 0)
+            return false;
+        const upper = checkId.toUpperCase();
+        return patterns.some(pattern => {
+            if (pattern.includes('*')) {
+                // Convert glob pattern to regex: escape special chars, replace * with .*
+                const regexStr = '^' + pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*') + '$';
+                return new RegExp(regexStr).test(upper);
+            }
+            return upper === pattern;
+        });
+    }
+    /**
+     * Re-apply .hmaignore filters to a set of findings.
+     * Call this after NanoMind merge overwrites result.findings with unfiltered data.
+     */
+    async reapplyIgnoreFilters(findings, targetDir, additionalIgnorePaths) {
+        const hmaIgnore = await this.loadHmaIgnore(targetDir);
+        const allIgnoredPaths = [...hmaIgnore.paths, ...(additionalIgnorePaths || [])];
+        const suppressedCheckPatterns = hmaIgnore.checkIds;
+        if (allIgnoredPaths.length === 0 && suppressedCheckPatterns.length === 0) {
+            return findings;
+        }
+        return findings.filter(f => {
+            if (this.isCheckIdSuppressed(f.checkId, suppressedCheckPatterns))
+                return false;
+            if (f.file && this.isPathIgnored(f.file, allIgnoredPaths))
+                return false;
+            return true;
+        });
+    }
     /**
      * Check if a file path matches any .hmaignore pattern.
      */
@@ -293,10 +342,12 @@ class HardeningScanner {
         const scanDepth = options.scanDepth || (options.deep ? 'deep' : 'standard');
         const isQuick = scanDepth === 'quick';
         const isDeepScan = scanDepth === 'deep';
-        // Load .hmaignore for path-based exclusions
-        const hmaIgnorePaths = await this.loadHmaIgnore(targetDir);
+        // Load .hmaignore for path-based exclusions and check ID suppressions
+        const hmaIgnore = await this.loadHmaIgnore(targetDir);
         // Merge with any programmatic ignorePaths
-        const allIgnoredPaths = [...hmaIgnorePaths, ...(options.ignorePaths || [])];
+        const allIgnoredPaths = [...hmaIgnore.paths, ...(options.ignorePaths || [])];
+        // Check ID suppression patterns from .hmaignore (supports wildcards)
+        const suppressedCheckPatterns = hmaIgnore.checkIds;
         // Normalize ignore list to uppercase for case-insensitive matching
         const ignoredChecks = new Set(ignore.map((id) => id.toUpperCase()));
         // In dry-run mode, we detect what would be fixed but don't modify anything
@@ -558,7 +609,8 @@ class HardeningScanner {
         // Filter findings to only show real, actionable issues:
         // 1. Only failed checks (passed: false)
         // 2. Only checks with a file path (concrete findings, not generic advice)
-        // 3. Filter out ignored checks
+        // 3. Only checks that apply to this project type (e.g., no SQL checks on MCP servers)
+        // 4. Filter out ignored checks
         let filteredFindings = findings.filter((f) => {
             // Keep fixed findings (so users can see what was fixed)
             // Otherwise, only show failed checks
@@ -567,9 +619,15 @@ class HardeningScanner {
             // Only show concrete findings (has a file path)
             if (!f.file)
                 return false;
-            // Filter out ignored checks
+            // Only show checks relevant to this project type
+            if (!this.findingAppliesTo(f, projectType))
+                return false;
+            // Filter out ignored checks (from --ignore flag)
             if (ignoredChecks.has(f.checkId.toUpperCase()))
                 return false;
+            // Filter out check IDs suppressed via .hmaignore (supports wildcards)
+            if (this.isCheckIdSuppressed(f.checkId, suppressedCheckPatterns))
+                return false;
             // Filter out paths matching .hmaignore
             if (f.file && this.isPathIgnored(f.file, allIgnoredPaths))
                 return false;
@@ -702,21 +760,21 @@ class HardeningScanner {
             const pkgPath = path.join(targetDir, 'package.json');
             const content = await fs.readFile(pkgPath, 'utf-8');
             const pkg = JSON.parse(content);
-            // Check if it's a CLI tool (has bin field)
-            if (pkg.bin) {
-                return 'cli';
-            }
             // Check dependencies for framework detection
             const allDeps = {
                 ...pkg.dependencies,
                 ...pkg.devDependencies,
             };
-            // Check for MCP server
+            // Check for MCP server BEFORE cli -- MCP servers often have bin fields
             if (allDeps['@modelcontextprotocol/sdk'] ||
                 allDeps['mcp'] ||
                 pkg.name?.includes('mcp')) {
                 return 'mcp';
             }
+            // Check if it's a CLI tool (has bin field)
+            if (pkg.bin) {
+                return 'cli';
+            }
             // Check for web frameworks
             if (allDeps['react'] ||
                 allDeps['vue'] ||