hackmyagent 0.17.8 → 0.17.9

package/dist/hardening/scanner.d.ts

@@ -51,6 +51,36 @@ export declare function calculateSecurityScore(findings: Array<{
     score: number;
     maxScore: number;
 };
+/**
+ * Check if a finding applies to the given project type based on the
+ * CHECK_PROJECT_TYPES map. Exported so CLI can filter findings after
+ * NanoMind merge.
+ */
+export declare function findingAppliesTo(finding: SecurityFinding, projectType: ProjectType): boolean;
+/**
+ * Parsed .hmaignore rules split into path patterns and check ID patterns.
+ * Check ID patterns start with `!` and support trailing `*` wildcards.
+ * Example: `!SANDBOX-*` suppresses all SANDBOX checks.
+ */
+export interface HmaIgnoreRules {
+    paths: string[];
+    checkIds: string[];
+}
+/**
+ * Load .hmaignore patterns from a target directory. Exported so CLI
+ * can re-apply ignore filtering after NanoMind merge.
+ */
+export declare function loadHmaIgnore(targetDir: string): Promise<HmaIgnoreRules>;
+/**
+ * Check if a file path matches any .hmaignore path pattern. Exported so CLI
+ * can filter findings after NanoMind merge.
+ */
+export declare function isPathIgnored(filePath: string, ignoredPaths: string[]): boolean;
+/**
+ * Check if a checkId matches any .hmaignore check ID pattern.
+ * Supports exact match and trailing `*` wildcard (e.g. `SANDBOX-*`).
+ */
+export declare function isCheckIgnored(checkId: string, ignoredChecks: string[]): boolean;
 export declare class HardeningScanner {
     private cliName;
     private static readonly BACKUP_FILES;
@@ -83,6 +113,12 @@ export declare class HardeningScanner {
      * Detect the project type based on package.json and project structure
      */
     private detectProjectType;
+    /**
+     * Detect if a package is an SDK/API client. Requires 2+ independent
+     * signals to avoid false positives (a random library with axios isn't
+     * necessarily an SDK).
+     */
+    private detectSDKPackage;
     /**
      * Check if a finding applies to the given project type
      */

package/dist/hardening/scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../src/hardening/scanner.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAY,WAAW,EAAE,MAAM,kBAAkB,CAAC;AA4G3F,0CAA0C;AAC1C,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;AAEtD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,oDAAoD;IACpD,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA6HD;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG;IACrJ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB,CAgCA;AA6GD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,OAAO,CAAiB;IAEhC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CA2BlC;IAEF;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAM7B;;;OAGG;YACW,aAAa;IAwB3B;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAa3B;;;OAGG;IACG,oBAAoB,CACxB,QAAQ,EAAE,eAAe,EAAE,EAC3B,SAAS,EAAE,MAAM,EACjB,qBAAqB,CAAC,EAAE,MAAM,EAAE,GAC/B,OAAO,CAAC,eAAe,EAAE,CAAC;IAgB7B;;OAEG;IACH,OAAO,CAAC,aAAa;IASf,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;YA+ZvC,cAAc;IAwE5B;;OAEG;YACW,iBAAiB;IA+F/B;;OAEG;IACH,gBAAgB,CAAC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,GAAG,OAAO;YAe/D,uBAAuB;YA4GvB,aAAa;YAiDb,cAAc;YAiGd,oBAAoB;YAyDpB,gBAAgB;YAgJhB,oBAAoB;YAkFpB,gBAAgB;YA8IhB,mBAAmB;YA8EnB,iBAAiB;YA0CjB,iBAAiB;YAiEjB,wBAAwB;YA6FxB,wBAAwB;YAqExB,wBAAwB;YAyHxB,oBAAoB;YAmHpB,uBAAuB;YA4IvB,iBAAiB;YAkHjB,oBAAoB;YA0HpB,mBAAmB;YAqGnB,gBAAgB;YAwIhB,oBAAoB;YAwIpB,gBAAgB;YA6HhB,qBAAqB;YAmHrB,eAAe;IAqI7B;;OAEG;YACW,mBAAmB;IAkHjC;;OAEG;YACW,oBAAoB;IAqKlC;;OAEG;YACW,iBAAiB;IAgJ/B;;OAEG;YACW,oBAAoB;IA4IlC;;OAEG;YACW,eAAe;IAyJ7B;;OAEG;YACW,eAAe;IA2I7B;;OAEG;YACW,eAAe;IA6G7B;;OAEG;YACW,mBAAmB;IAuHjC,cAAc,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG;QAC3C,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;KAClB;IAID;;OAEG;YACW,YAAY;IAmE1B;;OAEG;IACG,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA6DhD;;;OAGG;YACW,cAAc;IAgD5B;;OAEG;YACW,mBAAmB;IA8qBjC;;;OAGG;YACW,kBAAkB;IAgDhC;;OAEG;YACW,sBAAsB;IAkMpC;;OAEG;YACW,sBAAsB;IA+BpC;;OAEG;YACW,oBAAoB;IAgWlC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA4B3B;;OAEG;YACW,iBAAiB;IA8D/B;;OAEG;YACW,mBAAmB;IAsXjC;;OAEG;YACW,wBAAwB;IAqPtC;;OAEG;YACW,gBAAgB;IAoK9B;;;OAGG;YACW,eAAe;IAoD7B;;;OAGG;YACW,aAAa;IAwC3B;;;OAGG;YACW,oBAAoB;IAoKlC;;;OAGG;YACW,iBAAiB;IAiI/B;;;OAGG;YACW,kBAAkB;IAkFhC;;;OAGG;YACW,aAAa;IA0F3B;;OAEG;YACW,gBAAgB;IAiE9B;;;;OAIG;YACW,yBAAyB;IA+YvC;;;;;OAKG;YACW,qBAAqB;IAqnBnC;;;;OAIG;YACW,gBAAgB;IA2G9B;;;;OAIG;YACW,mBAAmB;IAmKjC;;;;OAIG;YACW,gBAAgB;IAkF9B;;;OAGG;YACW,iBAAiB;IA+C/B;;;;OAIG;YACW,yBAAyB;IA6FvC;;;OAGG;YACW,kBAAkB;IA8ChC;;;OAGG;YACW,mBAAmB;IA4CjC;;;OAGG;YACW,6BAA6B;IAiD3C;;;OAGG;YACW,oBAAoB;IA4ClC;;;OAGG;YACW,WAAW;IA4DzB;;;OAGG;YACW,aAAa;IAgD3B;;;OAGG;YACW,oBAAoB;IA6ClC;;;OAGG;YACW,YAAY;IAmD1B;;;OAGG;YACW,qBAAqB;IA+DnC;;;;OAIG;YACW,oBAAoB;IAyHlC;;;OAGG;YACW,iBAAiB;IA+F/B;;;OAGG;YACW,4BAA4B;IAqD1C;;;OAGG;YACW,8BAA8B;IAgE5C;;;;OAIG;YACW,qBAAqB;IAgBnC,+DAA+D;YACjD,YAAY;CA+B3B"}
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../src/hardening/scanner.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAY,WAAW,EAAE,MAAM,kBAAkB,CAAC;AA4G3F,0CAA0C;AAC1C,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;AAEtD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,oDAAoD;IACpD,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA6HD;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG;IACrJ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB,CAgCA;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,GAAG,OAAO,CAQ5F;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAe9E;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,OAAO,CAO/E;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,CAQhF;AA6GD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,OAAO,CAAiB;IAEhC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CA2BlC;IAEF;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAM7B;;;OAGG;YACW,aAAa;IAwB3B;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAa3B;;;OAGG;IACG,oBAAoB,CACxB,QAAQ,EAAE,eAAe,EAAE,EAC3B,SAAS,EAAE,MAAM,EACjB,qBAAqB,CAAC,EAAE,MAAM,EAAE,GAC/B,OAAO,CAAC,eAAe,EAAE,CAAC;IAgB7B;;OAEG;IACH,OAAO,CAAC,aAAa;IASf,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;YAgavC,cAAc;IAwE5B;;OAEG;YACW,iBAAiB;IA4G/B;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IA8CxB;;OAEG;IACH,gBAAgB,CAAC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,GAAG,OAAO;YAe/D,uBAAuB;YA4GvB,aAAa;YAiDb,cAAc;YAiGd,oBAAoB;YAyDpB,gBAAgB;YAgJhB,oBAAoB;YAkFpB,gBAAgB;YA8IhB,mBAAmB;YA8EnB,iBAAiB;YA0CjB,iBAAiB;YAiEjB,wBAAwB;YA6FxB,wBAAwB;YAqExB,wBAAwB;YAyHxB,oBAAoB;YAmHpB,uBAAuB;YA4IvB,iBAAiB;YAkHjB,oBAAoB;YA0HpB,mBAAmB;YAqGnB,gBAAgB;YAwIhB,oBAAoB;YAwIpB,gBAAgB;YA6HhB,qBAAqB;YAmHrB,eAAe;IAqI7B;;OAEG;YACW,mBAAmB;IAkHjC;;OAEG;YACW,oBAAoB;IAqKlC;;OAEG;YACW,iBAAiB;IAgJ/B;;OAEG;YACW,oBAAoB;IA4IlC;;OAEG;YACW,eAAe;IAyJ7B;;OAEG;YACW,eAAe;IA2I7B;;OAEG;YACW,eAAe;IA6G7B;;OAEG;YACW,mBAAmB;IAuHjC,cAAc,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG;QAC3C,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;KAClB;IAID;;OAEG;YACW,YAAY;IAmE1B;;OAEG;IACG,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA6DhD;;;OAGG;YACW,cAAc;IAgD5B;;OAEG;YACW,mBAAmB;IA8qBjC;;;OAGG;YACW,kBAAkB;IAgDhC;;OAEG;YACW,sBAAsB;IAkMpC;;OAEG;YACW,sBAAsB;IA+BpC;;OAEG;YACW,oBAAoB;IAgWlC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA4B3B;;OAEG;YACW,iBAAiB;IA8D/B;;OAEG;YACW,mBAAmB;IAsXjC;;OAEG;YACW,wBAAwB;IAqPtC;;OAEG;YACW,gBAAgB;IAoK9B;;;OAGG;YACW,eAAe;IAoD7B;;;OAGG;YACW,aAAa;IAwC3B;;;OAGG;YACW,oBAAoB;IAoKlC;;;OAGG;YACW,iBAAiB;IAiI/B;;;OAGG;YACW,kBAAkB;IAkFhC;;;OAGG;YACW,aAAa;IA0F3B;;OAEG;YACW,gBAAgB;IAiE9B;;;;OAIG;YACW,yBAAyB;IA+YvC;;;;;OAKG;YACW,qBAAqB;IAqnBnC;;;;OAIG;YACW,gBAAgB;IA2G9B;;;;OAIG;YACW,mBAAmB;IAmKjC;;;;OAIG;YACW,gBAAgB;IAkF9B;;;OAGG;YACW,iBAAiB;IA+C/B;;;;OAIG;YACW,yBAAyB;IA6FvC;;;OAGG;YACW,kBAAkB;IA8ChC;;;OAGG;YACW,mBAAmB;IA4CjC;;;OAGG;YACW,6BAA6B;IAiD3C;;;OAGG;YACW,oBAAoB;IA4ClC;;;OAGG;YACW,WAAW;IA4DzB;;;OAGG;YACW,aAAa;IAgD3B;;;OAGG;YACW,oBAAoB;IA6ClC;;;OAGG;YACW,YAAY;IAmD1B;;;OAGG;YACW,qBAAqB;IA+DnC;;;;OAIG;YACW,oBAAoB;IAyHlC;;;OAGG;YACW,iBAAiB;IA+F/B;;;OAGG;YACW,4BAA4B;IAqD1C;;;OAGG;YACW,8BAA8B;IAgE5C;;;;OAIG;YACW,qBAAqB;IAgBnC,+DAA+D;YACjD,YAAY;CA+B3B"}

package/dist/hardening/scanner.js

@@ -39,6 +39,10 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.HardeningScanner = void 0;
 exports.calculateSecurityScore = calculateSecurityScore;
+exports.findingAppliesTo = findingAppliesTo;
+exports.loadHmaIgnore = loadHmaIgnore;
+exports.isPathIgnored = isPathIgnored;
+exports.isCheckIgnored = isCheckIgnored;
 const fs = __importStar(require("fs/promises"));
 const crypto = __importStar(require("crypto"));
 const path = __importStar(require("path"));
@@ -283,6 +287,69 @@ function calculateSecurityScore(findings) {
         : Math.round(100 * Math.exp(-weightedSum / DECAY_CONSTANT));
     return { score, maxScore: 100 };
 }
+/**
+ * Check if a finding applies to the given project type based on the
+ * CHECK_PROJECT_TYPES map. Exported so CLI can filter findings after
+ * NanoMind merge.
+ */
+function findingAppliesTo(finding, projectType) {
+    for (const [prefix, types] of Object.entries(CHECK_PROJECT_TYPES)) {
+        if (finding.checkId.startsWith(prefix)) {
+            if (types.includes('all'))
+                return true;
+            return types.includes(projectType);
+        }
+    }
+    return true;
+}
+/**
+ * Load .hmaignore patterns from a target directory. Exported so CLI
+ * can re-apply ignore filtering after NanoMind merge.
+ */
+async function loadHmaIgnore(targetDir) {
+    const ignorePath = path.join(targetDir, '.hmaignore');
+    try {
+        const content = await fs.readFile(ignorePath, 'utf-8');
+        const lines = content
+            .split('\n')
+            .map(line => line.trim())
+            .filter(line => line && !line.startsWith('#'));
+        return {
+            paths: lines.filter(l => !l.startsWith('!')),
+            checkIds: lines.filter(l => l.startsWith('!')).map(l => l.slice(1)),
+        };
+    }
+    catch {
+        return { paths: [], checkIds: [] };
+    }
+}
+/**
+ * Check if a file path matches any .hmaignore path pattern. Exported so CLI
+ * can filter findings after NanoMind merge.
+ */
+function isPathIgnored(filePath, ignoredPaths) {
+    if (!filePath || ignoredPaths.length === 0)
+        return false;
+    const normalized = filePath.replace(/\\/g, '/');
+    return ignoredPaths.some(pattern => {
+        const normalizedPattern = pattern.replace(/\\/g, '/').replace(/\/$/, '');
+        return normalized.startsWith(normalizedPattern + '/') || normalized === normalizedPattern;
+    });
+}
+/**
+ * Check if a checkId matches any .hmaignore check ID pattern.
+ * Supports exact match and trailing `*` wildcard (e.g. `SANDBOX-*`).
+ */
+function isCheckIgnored(checkId, ignoredChecks) {
+    if (!checkId || ignoredChecks.length === 0)
+        return false;
+    return ignoredChecks.some(pattern => {
+        if (pattern.endsWith('*')) {
+            return checkId.startsWith(pattern.slice(0, -1));
+        }
+        return checkId === pattern;
+    });
+}
 const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB max file size to prevent memory exhaustion
 const MAX_LINE_LENGTH = 10000; // 10KB max line length for regex safety
 /** Shell-escape a string for safe interpolation into advisory fix commands. */
@@ -488,6 +555,7 @@ class HardeningScanner {
         // Check ID suppression patterns from .hmaignore (supports wildcards)
         const suppressedCheckPatterns = hmaIgnore.checkIds;
         // Normalize ignore list to uppercase for case-insensitive matching
+        // Merge CLI --ignore flags with .hmaignore !-prefixed check IDs
         const ignoredChecks = new Set(ignore.map((id) => id.toUpperCase()));
         // In dry-run mode, we detect what would be fixed but don't modify anything
         const shouldFix = autoFix && !dryRun;
@@ -879,7 +947,7 @@ class HardeningScanner {
      */
     async detectProjectType(targetDir) {
         // Check for OpenClaw project indicators (check first as it's more specific)
-        const openclawIndicators = ['.openclaw', '.moltbot', '.clawdbot', 'SKILL.md', 'openclaw.json'];
+        const openclawIndicators = ['.openclaw', '.moltbot', '.clawdbot', 'SKILL.md', 'HEARTBEAT.md', 'openclaw.json'];
         for (const indicator of openclawIndicators) {
             try {
                 await fs.access(path.join(targetDir, indicator));
@@ -887,7 +955,7 @@ class HardeningScanner {
             }
             catch { }
         }
-        // Check for *.skill.md files (OpenClaw skill project)
+        // Check for *.skill.md files at root level (OpenClaw skill project)
         try {
             const files = await fs.readdir(targetDir);
             if (files.some(f => f.endsWith('.skill.md'))) {
@@ -895,6 +963,12 @@ class HardeningScanner {
             }
         }
         catch { }
+        // Check for skills/ subdirectory with SKILL.md files (common OpenClaw layout)
+        try {
+            await fs.access(path.join(targetDir, 'skills'));
+            return 'openclaw';
+        }
+        catch { }
         try {
             const pkgPath = path.join(targetDir, 'package.json');
             const content = await fs.readFile(pkgPath, 'utf-8');
@@ -910,6 +984,12 @@ class HardeningScanner {
                 pkg.name?.includes('mcp')) {
                 return 'mcp';
             }
+            // Check for SDK/API client packages (requires 2+ signals).
+            // Must run before CLI check: some SDKs ship CLI shims (e.g., openai)
+            // but are primarily libraries.
+            if (this.detectSDKPackage(pkg, allDeps)) {
+                return 'sdk';
+            }
             // Check if it's a CLI tool (has bin field)
             if (pkg.bin) {
                 return 'cli';
@@ -959,6 +1039,44 @@ class HardeningScanner {
         // Default to library for generic projects
         return 'library';
     }
+    /**
+     * Detect if a package is an SDK/API client. Requires 2+ independent
+     * signals to avoid false positives (a random library with axios isn't
+     * necessarily an SDK).
+     */
+    detectSDKPackage(pkg, allDeps) {
+        const name = (pkg.name ?? '').toLowerCase();
+        const desc = (pkg.description ?? '').toLowerCase();
+        const keywords = pkg.keywords ?? [];
+        // Signal 1: Package name contains SDK/client indicators
+        const nameSignals = ['/sdk', '-sdk', '-client', 'api-client', '-api']
+            .some(s => name.includes(s)) || name.endsWith('sdk');
+        // Signal 2: Description mentions SDK/client/wrapper/library-for-API patterns
+        const descSignals = [
+            'sdk', 'client library', 'api client', 'api wrapper', 'official client',
+            'library for the', 'library for', 'client for the', 'client for',
+        ].some(s => desc.includes(s)) && desc.includes('api');
+        // Signal 3: Has library exports (main/exports). SDKs may also ship CLI
+        // shims, so we don't exclude on bin presence.
+        const hasLibraryExports = !!(pkg.main || pkg.exports || pkg.module);
+        // Signal 4: Depends on HTTP clients
+        const httpDeps = ['node-fetch', 'axios', 'got', 'undici', 'cross-fetch', 'ky', 'superagent']
+            .some(d => d in allDeps);
+        // Signal 5: Keywords include sdk/client
+        const kwSignals = keywords.some(k => ['sdk', 'client', 'api-client', 'wrapper'].includes(k.toLowerCase()));
+        // Signal 6: Description pattern "for the X API" -- strong signal that
+        // this is an API client library
+        const forApiPattern = /\bfor\s+the\s+\w+\s+api\b/i.test(desc) ||
+            /\b(official|typescript|javascript|node)\s+\w*\s*(library|client|sdk)\b/i.test(desc);
+        const signalCount = [
+            nameSignals,
+            descSignals,
+            hasLibraryExports && httpDeps,
+            kwSignals,
+            forApiPattern && hasLibraryExports,
+        ].filter(Boolean).length;
+        return signalCount >= 2;
+    }
     /**
      * Check if a finding applies to the given project type
      */