hackmyagent 0.17.6 → 0.17.8

package/dist/cli.js

@@ -247,6 +247,7 @@ Examples:
                 },
                 verbose: !!options.verbose,
                 usedAnalm: !!options.analm,
+                analystFindings: nmResult.analystFindings,
             });
             const risk = critical.length > 0 ? 'critical' : high.length > 0 ? 'high' : issues.length > 0 ? 'medium' : 'low';
             if (risk === 'critical' || risk === 'high')
@@ -773,6 +774,81 @@ function displayUnifiedCheck(opts) {
             console.log(`  ${colors.dim}${legend}${RESET()}`);
         }
     }
+    // ── AnaLM Analysis ──────────────────────────────────────────────────
+    if (opts.analystFindings && opts.analystFindings.length > 0) {
+        divider('AnaLM Analysis');
+        for (const af of opts.analystFindings) {
+            const r = af.result;
+            if (af.taskType === 'threatAnalysis') {
+                const level = String(r.threatLevel ?? 'unknown').toUpperCase();
+                const levelColor = level === 'CRITICAL' || level === 'HIGH' ? colors.red : level === 'MEDIUM' ? colors.yellow : colors.dim;
+                console.log(`  ${levelColor}${colors.bold}${level}${RESET()}  ${r.attackVector ?? ''}`);
+                if (r.description)
+                    console.log(`  ${colors.dim}${r.description}${RESET()}`);
+                if (Array.isArray(r.mitigations) && r.mitigations.length > 0) {
+                    for (const m of r.mitigations) {
+                        console.log(`  ${colors.cyan}Fix:${RESET()} ${m}`);
+                    }
+                }
+            }
+            else if (af.taskType === 'credentialContextClassification') {
+                const cls = String(r.classification ?? 'unknown');
+                const clsColor = cls === 'real' ? colors.red : cls === 'test' || cls === 'example' ? colors.green : colors.yellow;
+                console.log(`  Credential: ${clsColor}${colors.bold}${cls}${RESET()}`);
+                if (r.reasoning)
+                    console.log(`  ${colors.dim}${r.reasoning}${RESET()}`);
+            }
+            else if (af.taskType === 'intelReport') {
+                if (r.summary)
+                    console.log(`  ${colors.cyan}Summary:${RESET()} ${r.summary}`);
+                if (Array.isArray(r.keyFindings) && r.keyFindings.length > 0) {
+                    for (const kf of r.keyFindings) {
+                        console.log(`  ${colors.dim}${kf}${RESET()}`);
+                    }
+                }
+                if (r.riskAssessment)
+                    console.log(`  ${colors.cyan}Risk:${RESET()}    ${r.riskAssessment}`);
+                if (Array.isArray(r.recommendations) && r.recommendations.length > 0) {
+                    for (const rec of r.recommendations) {
+                        console.log(`  ${colors.dim}${rec}${RESET()}`);
+                    }
+                }
+            }
+            else if (af.taskType === 'governanceReasoning') {
+                if (Array.isArray(r.gaps) && r.gaps.length > 0) {
+                    console.log(`  ${colors.yellow}Governance gaps:${RESET()}`);
+                    for (const gap of r.gaps)
+                        console.log(`  ${colors.dim}- ${gap}${RESET()}`);
+                }
+                if (Array.isArray(r.recommendations) && r.recommendations.length > 0) {
+                    for (const rec of r.recommendations) {
+                        console.log(`  ${colors.cyan}Fix:${RESET()} ${rec}`);
+                    }
+                }
+            }
+            else if (af.taskType === 'checkExplanation') {
+                if (r.explanation)
+                    console.log(`  ${r.explanation}`);
+                if (r.impact)
+                    console.log(`  ${colors.yellow}Impact:${RESET()} ${r.impact}`);
+                if (r.recommendation)
+                    console.log(`  ${colors.cyan}Fix:${RESET()} ${r.recommendation}`);
+            }
+            else if (af.taskType === 'falsePositiveDetection') {
+                const fp = Boolean(r.isFalsePositive);
+                console.log(`  ${fp ? colors.green : colors.yellow}${fp ? 'Likely false positive' : 'Likely real finding'}${RESET()}`);
+                if (r.reasoning)
+                    console.log(`  ${colors.dim}${r.reasoning}${RESET()}`);
+            }
+            else {
+                // Generic display
+                if (r.description)
+                    console.log(`  ${r.description}`);
+            }
+            console.log(`  ${colors.dim}Confidence: ${Math.round(af.confidence * 100)}% | ${af.modelVersion} (${af.durationMs}ms)${RESET()}`);
+            console.log();
+        }
+    }
     // ── Next steps ──────────────────────────────────────────────────────
     const hasGovIssues = failed.some(f => f.category === 'governance' || f.category === 'Governance' || f.checkId?.startsWith('AST-GOV') || f.checkId?.startsWith('AST-PROMPT'));
     const hasCredIssues = failed.some(f => f.checkId?.startsWith('CRED-') || f.name?.toLowerCase().includes('credential') || f.name?.toLowerCase().includes('api key') || f.name?.toLowerCase().includes('hardcoded'));
@@ -6319,7 +6395,8 @@ function looksLikeRawUrl(target) {
  */
 function parseGitHubTarget(target) {
     // Full URL: https://github.com/org/repo[.git][/tree/...]
-    const urlMatch = target.match(/^https?:\/\/(www\.)?github\.com\/([^/]+)\/([^/.]+)/);
+    // Allow dots in repo names (e.g. next.js, vue.js) but strip trailing .git
+    const urlMatch = target.match(/^https?:\/\/(www\.)?github\.com\/([^/]+)\/([^/]+?)(?:\.git)?(?:\/|$)/);
     if (urlMatch) {
         return {
             org: urlMatch[2],
@@ -6603,17 +6680,95 @@ const TEST_FILE_PATTERNS = [
     /[^/]+\.spec\.\w+$/,
     /\bfixtures?\//i,
 ];
+/**
+ * Documentation and generated file patterns.
+ * These files describe security concepts (credentials, prompts, governance)
+ * but are not attack surfaces themselves. Governance/credential/prompt
+ * findings on these are almost always false positives in cloned repos.
+ */
+const DOCS_AND_GENERATED_PATTERNS = [
+    /\.md$/i, // Markdown documentation
+    /\.rst$/i, // reStructuredText docs
+    /\bdocs?\//i, // docs/ directory
+    /\bdocumentation\//i, // documentation/ directory
+    /\bexamples?\//i, // examples/ directory
+    /\bsamples?\//i, // samples/ directory
+    /openapi[^/]*\.json$/i, // OpenAPI spec files
+    /openapi[^/]*\.ya?ml$/i, // OpenAPI spec YAML files
+    /swagger[^/]*\.json$/i, // Swagger spec files
+    /swagger[^/]*\.ya?ml$/i, // Swagger spec YAML files
+    /\bapi\/openapi-spec\//i, // API spec directories
+    /\bapi\/discovery\//i, // API discovery docs
+    /\bvendor\//i, // vendored dependencies
+    /\bthird.?party\//i, // third-party code
+    /\bCHANGELOG/i, // changelog files
+    /\bHISTORY/i, // history files
+    /\bLICENSE/i, // license files
+    /\bCONTRIBUTING/i, // contributing guides
+    /\.tmLanguage\.json$/i, // TextMate grammars
+    /\.schema\.json$/i, // JSON schema definitions
+    /\.nls\.json$/i, // localization/NLS files
+    /\bcglicenses/i, // CG license files
+    /\blicenses?\//i, // license directories
+];
+/**
+ * Check IDs for security-sensitive pattern matches that produce false
+ * positives on documentation and generated files. These checks look for
+ * credential patterns, prompt injection, governance gaps, and skill
+ * definitions — all of which appear naturally in docs that DESCRIBE
+ * these concepts without being vulnerable.
+ */
+const DOCS_FALSE_POSITIVE_PREFIXES = [
+    'AST-GOV', // governance checks
+    'AST-GOVERN', // governance checks
+    'AST-PROMPT', // prompt security checks
+    'AST-HEARTBEAT', // heartbeat/liveness checks
+    'AST-CRED', // credential pattern checks
+    'AST-INJECT', // injection pattern checks
+    'AST-EXFIL', // exfiltration pattern checks
+    'SKILL-', // skill definition checks
+    'SUPPLY-', // supply chain checks
+];
+/**
+ * Build scripts, CI/CD pipelines, and infrastructure files.
+ * These are not runtime attack surfaces — findings here are lower risk.
+ */
+const BUILD_CI_PATTERNS = [
+    /\bbuild\//i, // build/ directory
+    /\bdist\//i, // dist/ directory
+    /\b\.github\//, // GitHub Actions
+    /\b\.circleci\//, // CircleCI
+    /\bazure-pipelines/i, // Azure Pipelines
+    /\bjenkins/i, // Jenkins
+    /\b\.gitlab-ci/, // GitLab CI
+    /\bMakefile$/i, // Makefiles
+    /\bGruntfile/i, // Grunt
+    /\bgulpfile/i, // Gulp
+    /\bwebpack\.\w+\.js$/i, // Webpack configs
+    /\brollup\.\w+\.js$/i, // Rollup configs
+    /\bscripts\//i, // scripts/ directory
+    /\btools?\//i, // tools/ directory
+    /\binfra\//i, // infra/ directory
+];
 function isTestFile(filePath) {
     return TEST_FILE_PATTERNS.some(p => p.test(filePath));
 }
+function isDocsOrGenerated(filePath) {
+    return DOCS_AND_GENERATED_PATTERNS.some(p => p.test(filePath));
+}
+function isBuildOrCiFile(filePath) {
+    return BUILD_CI_PATTERNS.some(p => p.test(filePath));
+}
 function isAiToolingFile(filePath) {
     return AI_TOOLING_PATH_PATTERNS.some(p => p.test(filePath));
 }
 /**
  * Filter out local-dev-only findings that are meaningless for downloaded
  * packages (e.g. "Missing .gitignore" on an npm tarball).  Also filters
- * governance findings on AI tooling files and demotes test file findings.
- * Mutates `result.findings` in place and recalculates the score.
+ * governance findings on AI tooling files, removes false-positive
+ * pattern matches on documentation/generated files, and demotes test
+ * and build file findings. Mutates `result.findings` in place and
+ * recalculates the score.
  */
 function filterLocalOnlyFindings(result, scanner) {
     result.findings = result.findings.filter(f => {
@@ -6626,14 +6781,29 @@ function filterLocalOnlyFindings(result, scanner) {
         // files are false positives — they describe security practices, not vulnerabilities.
         if (f.file && isAiToolingFile(f.file))
             return false;
+        // Exclude governance/credential/prompt/skill pattern-match findings on
+        // documentation, generated specs, and vendored files. These files
+        // naturally describe security concepts without being vulnerable.
+        // Structural checks (unicode steganography, TOCTOU, deserialization)
+        // are kept — those detect actual content issues regardless of file type.
+        if (f.file && isDocsOrGenerated(f.file)) {
+            const checkId = f.checkId || '';
+            if (DOCS_FALSE_POSITIVE_PREFIXES.some(p => checkId.startsWith(p))) {
+                return false;
+            }
+        }
         return true;
     });
-    // Demote test file findings to low severity (test code patterns are
-    // lower risk — pickle.load in a test file is not an attack surface)
+    // Demote test file and build script findings to low severity.
+    // Test code patterns are lower risk (pickle.load in a test file is not
+    // an attack surface). Build scripts, CI configs, and vendored code are
+    // not runtime attack surfaces for the end user.
     for (const f of result.findings) {
-        if (f.file && isTestFile(f.file) && (f.severity === 'critical' || f.severity === 'high')) {
-            f.originalSeverity = f.severity;
-            f.severity = 'low';
+        if (f.file && (f.severity === 'critical' || f.severity === 'high')) {
+            if (isTestFile(f.file) || isBuildOrCiFile(f.file)) {
+                f.originalSeverity = f.severity;
+                f.severity = 'low';
+            }
         }
     }
     result.score = scanner.calculateScore(result.findings.filter((f) => !f.passed && !f.fixed)).score;
@@ -6666,10 +6836,16 @@ function printCheckNextSteps(target, context) {
     }
     if (context?.hasFindings) {
         console.log(`  ${colors.cyan}Full project audit:${RESET()}   ${getFullScanHint()}`);
+        if (!context?.usedAnalm) {
+            console.log(`  ${colors.cyan}AI analysis:${RESET()}          ${CLI_PREFIX} check ${target} --analm`);
+        }
     }
     else if (context?.isCleanScan && isLocal) {
         console.log(`  ${colors.cyan}Governance scan:${RESET()}      ${CLI_PREFIX} scan-soul ${target}`);
         console.log(`  ${colors.cyan}Red-team test:${RESET()}        ${CLI_PREFIX} attack --local`);
+        if (!context?.usedAnalm) {
+            console.log(`  ${colors.cyan}AI analysis:${RESET()}          ${CLI_PREFIX} check ${target} --analm`);
+        }
     }
     else if (context?.isCleanScan) {
         if (!context?.usedAnalm) {
@@ -6785,6 +6961,7 @@ async function checkGitHubRepo(target, options) {
         const scanner = new index_1.HardeningScanner();
         const result = await scanner.scan({ targetDir: repoDir, autoFix: false });
         // Run NanoMind semantic analysis and re-filter
+        let analystFindings;
         try {
             const { orchestrateNanoMind } = await Promise.resolve().then(() => __importStar(require('./nanomind-core/orchestrate.js')));
             const nmResult = await orchestrateNanoMind(repoDir, result.findings, { silent: true, analm: options.analm });
@@ -6792,6 +6969,7 @@ async function checkGitHubRepo(target, options) {
             const projectType = result.projectType || 'library';
             result.findings = refiltered.filter((f) => !f.passed && f.file && scanner.findingAppliesTo(f, projectType));
             result.score = scanner.calculateScore(result.findings.filter((f) => !f.passed && !f.fixed)).score;
+            analystFindings = nmResult.analystFindings;
         }
         catch {
             // NanoMind unavailable — use base scan results
@@ -6804,7 +6982,7 @@ async function checkGitHubRepo(target, options) {
         const medium = failed.filter(f => f.severity === 'medium');
         const low = failed.filter(f => f.severity === 'low');
         if (options.json) {
-            writeJsonStdout({
+            const jsonOut = {
                 name: displayName,
                 type: 'github-repo',
                 source: 'local-scan',
@@ -6812,7 +6990,10 @@ async function checkGitHubRepo(target, options) {
                 score: result.score,
                 maxScore: result.maxScore,
                 findings: result.findings,
-            });
+            };
+            if (analystFindings?.length)
+                jsonOut.analystFindings = analystFindings;
+            writeJsonStdout(jsonOut);
             return;
         }
         // Await registry data (started in parallel with clone)
@@ -6825,6 +7006,8 @@ async function checkGitHubRepo(target, options) {
             localScan: { score: result.score, maxScore: result.maxScore, findings: result.findings },
             registry: registryData,
             verbose: !!options.verbose,
+            usedAnalm: !!options.analm,
+            analystFindings,
         });
         // Community contribution
         if (process.stdin.isTTY && !globalCiMode) {
@@ -6948,6 +7131,7 @@ async function checkPyPiPackage(target, options) {
         const scanner = new index_1.HardeningScanner();
         const result = await scanner.scan({ targetDir: extractDir, autoFix: false });
         // Run NanoMind semantic analysis and re-filter
+        let analystFindings;
         try {
             const { orchestrateNanoMind } = await Promise.resolve().then(() => __importStar(require('./nanomind-core/orchestrate.js')));
             const nmResult = await orchestrateNanoMind(extractDir, result.findings, { silent: true, analm: options.analm });
@@ -6955,6 +7139,7 @@ async function checkPyPiPackage(target, options) {
             const projectType = result.projectType || 'library';
             result.findings = refiltered.filter((f) => !f.passed && f.file && scanner.findingAppliesTo(f, projectType));
             result.score = scanner.calculateScore(result.findings.filter((f) => !f.passed && !f.fixed)).score;
+            analystFindings = nmResult.analystFindings;
         }
         catch {
             // NanoMind unavailable -- use base scan results
@@ -6967,7 +7152,7 @@ async function checkPyPiPackage(target, options) {
         const medium = failed.filter(f => f.severity === 'medium');
         const low = failed.filter(f => f.severity === 'low');
         if (options.json) {
-            writeJsonStdout({
+            const jsonOut = {
                 name,
                 type: 'pypi-package',
                 source: 'local-scan',
@@ -6976,7 +7161,10 @@ async function checkPyPiPackage(target, options) {
                 score: result.score,
                 maxScore: result.maxScore,
                 findings: result.findings,
-            });
+            };
+            if (analystFindings?.length)
+                jsonOut.analystFindings = analystFindings;
+            writeJsonStdout(jsonOut);
             return;
         }
         // Display results using unified display
@@ -6990,6 +7178,8 @@ async function checkPyPiPackage(target, options) {
             localScan: { score: result.score, maxScore: result.maxScore, findings: result.findings },
             registry: registryData,
             verbose: !!options.verbose,
+            usedAnalm: !!options.analm,
+            analystFindings,
         });
         if (critical.length > 0 || high.length > 0)
             process.exit(1);
@@ -7103,6 +7293,7 @@ async function checkRawUrl(url, options) {
         // Run full HMA scan + NanoMind
         const scanner = new index_1.HardeningScanner();
         const result = await scanner.scan({ targetDir: scanDir, autoFix: false });
+        let analystFindings;
         try {
             const { orchestrateNanoMind } = await Promise.resolve().then(() => __importStar(require('./nanomind-core/orchestrate.js')));
             const nmResult = await orchestrateNanoMind(scanDir, result.findings, { silent: true, analm: options.analm });
@@ -7110,6 +7301,7 @@ async function checkRawUrl(url, options) {
             const projectType = result.projectType || 'library';
             result.findings = refiltered.filter((f) => !f.passed && f.file && scanner.findingAppliesTo(f, projectType));
             result.score = scanner.calculateScore(result.findings.filter((f) => !f.passed && !f.fixed)).score;
+            analystFindings = nmResult.analystFindings;
         }
         catch {
             // NanoMind unavailable — use base scan results
@@ -7122,7 +7314,7 @@ async function checkRawUrl(url, options) {
         const medium = failed.filter(f => f.severity === 'medium');
         const low = failed.filter(f => f.severity === 'low');
         if (options.json) {
-            writeJsonStdout({
+            const jsonOut = {
                 name: displayName,
                 url,
                 type: 'raw-url',
@@ -7131,7 +7323,10 @@ async function checkRawUrl(url, options) {
                 score: result.score,
                 maxScore: result.maxScore,
                 findings: result.findings,
-            });
+            };
+            if (analystFindings?.length)
+                jsonOut.analystFindings = analystFindings;
+            writeJsonStdout(jsonOut);
             return;
         }
         // Display results using unified display
@@ -7141,6 +7336,8 @@ async function checkRawUrl(url, options) {
             projectType: result.projectType,
             localScan: { score: result.score, maxScore: result.maxScore, findings: result.findings },
             verbose: !!options.verbose,
+            usedAnalm: !!options.analm,
+            analystFindings,
         });
         // Community contribution (auto-share if opted in, no first-time prompt for URLs)
         if (process.stdin.isTTY && !globalCiMode) {
@@ -7185,7 +7382,7 @@ async function checkNpmPackage(name, options) {
                 writeJsonStdout({ ...registryData, source: 'registry' });
                 return;
             }
-            displayUnifiedCheck({ name, registry: registryData, verbose: !!options.verbose });
+            displayUnifiedCheck({ name, registry: registryData, verbose: !!options.verbose, usedAnalm: !!options.analm });
             return;
         }
         if (!options.json && !globalCiMode) {
@@ -7241,6 +7438,7 @@ async function checkNpmPackage(name, options) {
         const scanner = new index_1.HardeningScanner();
         const result = await scanner.scan({ targetDir: packageDir, autoFix: false });
         // Run NanoMind semantic analysis and re-filter (matches secure command pipeline)
+        let analystFindings;
         try {
             const { orchestrateNanoMind } = await Promise.resolve().then(() => __importStar(require('./nanomind-core/orchestrate.js')));
             const nmResult = await orchestrateNanoMind(packageDir, result.findings, { silent: true, analm: options.analm });
@@ -7248,6 +7446,7 @@ async function checkNpmPackage(name, options) {
             const projectType = result.projectType || 'library';
             result.findings = refiltered.filter((f) => !f.passed && f.file && scanner.findingAppliesTo(f, projectType));
             result.score = scanner.calculateScore(result.findings.filter((f) => !f.passed && !f.fixed)).score;
+            analystFindings = nmResult.analystFindings;
         }
         catch {
             // NanoMind unavailable — use base scan results
@@ -7258,7 +7457,7 @@ async function checkNpmPackage(name, options) {
         const critical = failed.filter(f => f.severity === 'critical');
         const high = failed.filter(f => f.severity === 'high');
         if (options.json) {
-            writeJsonStdout({
+            const jsonOut = {
                 name,
                 type: 'npm-package',
                 source: 'local-scan',
@@ -7266,7 +7465,10 @@ async function checkNpmPackage(name, options) {
                 score: result.score,
                 maxScore: result.maxScore,
                 findings: result.findings,
-            });
+            };
+            if (analystFindings?.length)
+                jsonOut.analystFindings = analystFindings;
+            writeJsonStdout(jsonOut);
             return;
         }
         // Await registry data (started in parallel with download)
@@ -7278,6 +7480,8 @@ async function checkNpmPackage(name, options) {
             localScan: { score: result.score, maxScore: result.maxScore, findings: result.findings },
             registry: registryData,
             verbose: !!options.verbose,
+            usedAnalm: !!options.analm,
+            analystFindings,
         });
         // Community contribution (after 3 scans, interactive only)
         if (process.stdin.isTTY && !globalCiMode) {