hackmyagent 0.8.0 → 0.9.0

package/dist/registry/contribution.js

@@ -0,0 +1,272 @@
+"use strict";
+/**
+ * Anonymous registry contribution for scan results.
+ *
+ * When users opt in (--contribute flag), scan results are submitted
+ * anonymously to the OpenA2A registry for aggregate security intelligence.
+ *
+ * What IS sent:
+ * - SHA256 hash of scanned artifact (for deduplication, not identification)
+ * - Scan type and version
+ * - Finding IDs and severities (no file paths or content)
+ * - Domain scores (for governance scans)
+ * - Agent tier classification
+ * - Timestamp and scanner version
+ *
+ * What is NEVER sent:
+ * - File paths, file content, or source code
+ * - Usernames, hostnames, or IP addresses
+ * - Environment variables or credential values
+ * - Directory structure or project names
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hashArtifact = hashArtifact;
+exports.generateContributionId = generateContributionId;
+exports.extractFindingIds = extractFindingIds;
+exports.countBySeverity = countBySeverity;
+exports.buildHardeningContribution = buildHardeningContribution;
+exports.buildGovernanceContribution = buildGovernanceContribution;
+exports.buildMcpContribution = buildMcpContribution;
+exports.buildAttackContribution = buildAttackContribution;
+exports.buildAgentScanContribution = buildAgentScanContribution;
+exports.submitContribution = submitContribution;
+const crypto = __importStar(require("crypto"));
+/**
+ * Generate SHA256 hash of content for artifact identification.
+ * The hash allows deduplication without revealing content.
+ */
+function hashArtifact(content) {
+    return crypto.createHash('sha256').update(content).digest('hex');
+}
+/**
+ * Generate a random contribution ID.
+ */
+function generateContributionId() {
+    return crypto.randomUUID();
+}
+/**
+ * Strip PII from a finding list -- return only check IDs.
+ */
+function extractFindingIds(findings) {
+    return [...new Set(findings.map(f => f.checkId))].sort();
+}
+/**
+ * Count findings by severity.
+ */
+function countBySeverity(findings) {
+    const failed = findings.filter(f => f.passed === false);
+    return {
+        critical: failed.filter(f => f.severity === 'critical').length,
+        high: failed.filter(f => f.severity === 'high').length,
+        medium: failed.filter(f => f.severity === 'medium').length,
+        low: failed.filter(f => f.severity === 'low').length,
+    };
+}
+/**
+ * Build a contribution payload from hardening scan results.
+ */
+function buildHardeningContribution(scannerVersion, artifactContent, findings, score, maxScore, durationMs) {
+    const counts = countBySeverity(findings);
+    return {
+        contributionId: generateContributionId(),
+        artifactHash: hashArtifact(artifactContent),
+        scanType: 'hardening',
+        scannerVersion,
+        scanTimestamp: new Date().toISOString(),
+        scanDurationMs: durationMs,
+        totalFindings: counts.critical + counts.high + counts.medium + counts.low,
+        criticalCount: counts.critical,
+        highCount: counts.high,
+        mediumCount: counts.medium,
+        lowCount: counts.low,
+        findingIds: extractFindingIds(findings.filter(f => !f.passed)),
+        score,
+        maxScore,
+    };
+}
+/**
+ * Build a contribution payload from governance scan results.
+ */
+function buildGovernanceContribution(scannerVersion, artifactContent, governanceScore, durationMs) {
+    const failed = governanceScore.results.filter(r => !r.passed);
+    const counts = countBySeverity(failed.map(r => ({ severity: r.severity, passed: false })));
+    return {
+        contributionId: generateContributionId(),
+        artifactHash: hashArtifact(artifactContent),
+        scanType: 'governance',
+        scannerVersion,
+        scanTimestamp: new Date().toISOString(),
+        scanDurationMs: durationMs,
+        totalFindings: failed.length,
+        criticalCount: counts.critical,
+        highCount: counts.high,
+        mediumCount: counts.medium,
+        lowCount: counts.low,
+        findingIds: failed.map(r => r.controlId),
+        score: governanceScore.overall,
+        maxScore: 100,
+        grade: governanceScore.grade,
+        governance: {
+            tier: governanceScore.tier,
+            domainScores: governanceScore.domains.map(d => ({
+                domain: d.domain,
+                score: d.score,
+                controlsPassed: d.controlsPassed,
+                controlsTotal: d.controlsTotal,
+            })),
+            criticalFailures: governanceScore.criticalFailures,
+        },
+    };
+}
+/**
+ * Build a contribution payload from MCP tool enumeration.
+ */
+function buildMcpContribution(scannerVersion, configContent, serverResults, durationMs) {
+    const allFindings = serverResults.flatMap(s => s.findings);
+    const counts = countBySeverity(allFindings.map(f => ({ severity: f.severity, passed: false })));
+    const categories = new Set();
+    for (const f of allFindings) {
+        if (f.checkId === 'MCPTOOL-001')
+            categories.add('execution');
+        if (f.checkId === 'MCPTOOL-002')
+            categories.add('filesystem');
+        if (f.checkId === 'MCPTOOL-003')
+            categories.add('network');
+        if (f.checkId === 'MCPTOOL-004')
+            categories.add('credential');
+    }
+    return {
+        contributionId: generateContributionId(),
+        artifactHash: hashArtifact(configContent),
+        scanType: 'mcp-enumeration',
+        scannerVersion,
+        scanTimestamp: new Date().toISOString(),
+        scanDurationMs: durationMs,
+        totalFindings: allFindings.length,
+        criticalCount: counts.critical,
+        highCount: counts.high,
+        mediumCount: counts.medium,
+        lowCount: counts.low,
+        findingIds: [...new Set(allFindings.map(f => f.checkId))].sort(),
+        mcpEnumeration: {
+            serversScanned: serverResults.length,
+            totalTools: serverResults.reduce((sum, s) => sum + s.toolCount, 0),
+            dangerousToolCount: allFindings.length,
+            categories: [...categories],
+        },
+    };
+}
+/**
+ * Build a contribution payload from attack scan results.
+ */
+function buildAttackContribution(scannerVersion, targetIdentifier, attackReport, durationMs) {
+    return {
+        contributionId: generateContributionId(),
+        artifactHash: hashArtifact(targetIdentifier),
+        scanType: 'attack',
+        scannerVersion,
+        scanTimestamp: new Date().toISOString(),
+        scanDurationMs: durationMs,
+        totalFindings: attackReport.bypassed,
+        criticalCount: 0,
+        highCount: attackReport.bypassed,
+        mediumCount: 0,
+        lowCount: 0,
+        findingIds: attackReport.categories,
+        attack: {
+            categories: attackReport.categories,
+            payloadsRun: attackReport.totalPayloads,
+            payloadsBlocked: attackReport.blocked,
+            payloadsBypassed: attackReport.bypassed,
+            blockRate: attackReport.blockRate,
+        },
+    };
+}
+/**
+ * Build a contribution payload from agent card scan results.
+ */
+function buildAgentScanContribution(scannerVersion, artifactContent, scanResult, durationMs) {
+    const counts = countBySeverity(scanResult.findings.map(f => ({ severity: f.severity, passed: f.passed })));
+    return {
+        contributionId: generateContributionId(),
+        artifactHash: hashArtifact(artifactContent),
+        scanType: 'agent-scan',
+        scannerVersion,
+        scanTimestamp: new Date().toISOString(),
+        scanDurationMs: durationMs,
+        totalFindings: counts.critical + counts.high + counts.medium + counts.low,
+        criticalCount: counts.critical,
+        highCount: counts.high,
+        mediumCount: counts.medium,
+        lowCount: counts.low,
+        findingIds: extractFindingIds(scanResult.findings.filter(f => !f.passed)),
+        score: scanResult.score,
+        maxScore: 100,
+        grade: scanResult.grade,
+        agentScan: {
+            checksTotal: scanResult.findings.length,
+            checksPassed: scanResult.findings.filter(f => f.passed).length,
+            criticalFailures: scanResult.criticalFailures.length,
+            hasPublicKey: typeof scanResult.card.publicKey === 'string' && scanResult.card.publicKey.length > 0,
+            hasAttestation: scanResult.card.aimAttestation != null,
+            trustScore: scanResult.card.aimAttestation?.trustScore,
+        },
+    };
+}
+/**
+ * Submit contribution to registry. Never throws -- contribution failure is non-fatal.
+ */
+async function submitContribution(registryUrl, payload) {
+    try {
+        const response = await fetch(`${registryUrl}/api/v1/registry/community/contribute`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'User-Agent': 'HackMyAgent-CLI',
+            },
+            body: JSON.stringify(payload),
+        });
+        if (!response.ok) {
+            const body = await response.json().catch(() => ({}));
+            return { status: 'failed', message: body.message || `HTTP ${response.status}` };
+        }
+        return await response.json();
+    }
+    catch {
+        return { status: 'failed', message: 'Network error' };
+    }
+}
+//# sourceMappingURL=contribution.js.map

package/dist/registry/contribution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contribution.js","sourceRoot":"","sources":["../../src/registry/contribution.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4FH,oCAEC;AAKD,wDAEC;AAKD,8CAEC;AAKD,0CAUC;AAKD,gEAyBC;AAKD,kEA2CC;AAKD,oDAyCC;AAKD,0DAiCC;AAKD,gEAuCC;AAKD,gDAuBC;AAnWD,+CAAiC;AAsFjC;;;GAGG;AACH,SAAgB,YAAY,CAAC,OAAe;IAC1C,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED;;GAEG;AACH,SAAgB,sBAAsB;IACpC,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAAC,QAAoC;IACpE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAC7B,QAAuD;IAEvD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC;IACxD,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM;QAC9D,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;QACtD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM;QAC1D,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM;KACrD,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,0BAA0B,CACxC,cAAsB,EACtB,eAAuB,EACvB,QAAwE,EACxE,KAAa,EACb,QAAgB,EAChB,UAAmB;IAEnB,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACzC,OAAO;QACL,cAAc,EAAE,sBAAsB,EAAE;QACxC,YAAY,EAAE,YAAY,CAAC,eAAe,CAAC;QAC3C,QAAQ,EAAE,WAAW;QACrB,cAAc;QACd,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACvC,cAAc,EAAE,UAAU;QAC1B,aAAa,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG;QACzE,aAAa,EAAE,MAAM,CAAC,QAAQ;QAC9B,SAAS,EAAE,MAAM,CAAC,IAAI;QACtB,WAAW,EAAE,MAAM,CAAC,MAAM;QAC1B,QAAQ,EAAE,MAAM,CAAC,GAAG;QACpB,UAAU,EAAE,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC9D,KAAK;QACL,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,2BAA2B,CACzC,cAAsB,EACtB,eAAuB,EACvB,eAOC,EACD,UAAmB;IAEnB,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAE3F,OAAO;QACL,cAAc,EAAE,sBAAsB,EAAE;QACxC,YAAY,EAAE,YAAY,CAAC,eAAe,CAAC;QAC3C,QAAQ,EAAE,YAAY;QACtB,cAAc;QACd,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACvC,cAAc,EAAE,UAAU;QAC1B,aAAa,EAAE,MAAM,CAAC,MAAM;QAC5B,aAAa,EAAE,MAAM,CAAC,QAAQ;QAC9B,SAAS,EAAE,MAAM,CAAC,IAAI;QACtB,WAAW,EAAE,MAAM,CAAC,MAAM;QAC1B,QAAQ,EAAE,MAAM,CAAC,GAAG;QACpB,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACxC,KAAK,EAAE,eAAe,CAAC,OAAO;QAC9B,QAAQ,EAAE,GAAG;QACb,KAAK,EAAE,eAAe,CAAC,KAAK;QAC5B,UAAU,EAAE;YACV,IAAI,EAAE,eAAe,CAAC,IAAI;YAC1B,YAAY,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC9C,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,cAAc,EAAE,CAAC,CAAC,cAAc;gBAChC,aAAa,EAAE,CAAC,CAAC,aAAa;aAC/B,CAAC,CAAC;YACH,gBAAgB,EAAE,eAAe,CAAC,gBAAgB;SACnD;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,oBAAoB,CAClC,cAAsB,EACtB,aAAqB,EACrB,aAIE,EACF,UAAmB;IAEnB,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAEhG,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,OAAO,KAAK,aAAa;YAAE,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC7D,IAAI,CAAC,CAAC,OAAO,KAAK,aAAa;YAAE,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC9D,IAAI,CAAC,CAAC,OAAO,KAAK,aAAa;YAAE,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,CAAC,OAAO,KAAK,aAAa;YAAE,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAChE,CAAC;IAED,OAAO;QACL,cAAc,EAAE,sBAAsB,EAAE;QACxC,YAAY,EAAE,YAAY,CAAC,aAAa,CAAC;QACzC,QAAQ,EAAE,iBAAiB;QAC3B,cAAc;QACd,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACvC,cAAc,EAAE,UAAU;QAC1B,aAAa,EAAE,WAAW,CAAC,MAAM;QACjC,aAAa,EAAE,MAAM,CAAC,QAAQ;QAC9B,SAAS,EAAE,MAAM,CAAC,IAAI;QACtB,WAAW,EAAE,MAAM,CAAC,MAAM;QAC1B,QAAQ,EAAE,MAAM,CAAC,GAAG;QACpB,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAChE,cAAc,EAAE;YACd,cAAc,EAAE,aAAa,CAAC,MAAM;YACpC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YAClE,kBAAkB,EAAE,WAAW,CAAC,MAAM;YACtC,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC;SAC5B;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,uBAAuB,CACrC,cAAsB,EACtB,gBAAwB,EACxB,YAMC,EACD,UAAmB;IAEnB,OAAO;QACL,cAAc,EAAE,sBAAsB,EAAE;QACxC,YAAY,EAAE,YAAY,CAAC,gBAAgB,CAAC;QAC5C,QAAQ,EAAE,QAAQ;QAClB,cAAc;QACd,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACvC,cAAc,EAAE,UAAU;QAC1B,aAAa,EAAE,YAAY,CAAC,QAAQ;QACpC,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,YAAY,CAAC,QAAQ;QAChC,WAAW,EAAE,CAAC;QACd,QAAQ,EAAE,CAAC;QACX,UAAU,EAAE,YAAY,CAAC,UAAU;QACnC,MAAM,EAAE;YACN,UAAU,EAAE,YAAY,CAAC,UAAU;YACnC,WAAW,EAAE,YAAY,CAAC,aAAa;YACvC,eAAe,EAAE,YAAY,CAAC,OAAO;YACrC,gBAAgB,EAAE,YAAY,CAAC,QAAQ;YACvC,SAAS,EAAE,YAAY,CAAC,SAAS;SAClC;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,0BAA0B,CACxC,cAAsB,EACtB,eAAuB,EACvB,UAMC,EACD,UAAmB;IAEnB,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAE3G,OAAO;QACL,cAAc,EAAE,sBAAsB,EAAE;QACxC,YAAY,EAAE,YAAY,CAAC,eAAe,CAAC;QAC3C,QAAQ,EAAE,YAAY;QACtB,cAAc;QACd,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACvC,cAAc,EAAE,UAAU;QAC1B,aAAa,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG;QACzE,aAAa,EAAE,MAAM,CAAC,QAAQ;QAC9B,SAAS,EAAE,MAAM,CAAC,IAAI;QACtB,WAAW,EAAE,MAAM,CAAC,MAAM;QAC1B,QAAQ,EAAE,MAAM,CAAC,GAAG;QACpB,UAAU,EAAE,iBAAiB,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACzE,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,QAAQ,EAAE,GAAG;QACb,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,SAAS,EAAE;YACT,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM;YACvC,YAAY,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM;YAC9D,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,CAAC,MAAM;YACpD,YAAY,EAAE,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;YACnG,cAAc,EAAE,UAAU,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI;YACtD,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU;SACvD;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,kBAAkB,CACtC,WAAmB,EACnB,OAA4B;IAE5B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,uCAAuC,EAAE;YAClF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,iBAAiB;aAChC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAA4B,CAAC;YAChF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAG,IAAI,CAAC,OAAkB,IAAI,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9F,CAAC;QAED,OAAO,MAAM,QAAQ,CAAC,IAAI,EAA0C,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;IACxD,CAAC;AACH,CAAC"}

package/dist/soul/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Soul module - Behavioral Governance Scanner
+ */
+export { SoulScanner, CONTROL_DEFS, DOMAIN_ORDER, GOVERNANCE_FILES } from './scanner';
+export type { AgentTier, SoulGrade, ControlCheck, DomainResult, SoulScanResult, HardenResult, } from './scanner';
+export { DOMAIN_TEMPLATES } from './templates';
+export type { DomainTemplate } from './templates';
+//# sourceMappingURL=index.d.ts.map

package/dist/soul/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/soul/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACtF,YAAY,EACV,SAAS,EACT,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,YAAY,GACb,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC"}

package/dist/soul/index.js

@@ -0,0 +1,14 @@
+"use strict";
+/**
+ * Soul module - Behavioral Governance Scanner
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DOMAIN_TEMPLATES = exports.GOVERNANCE_FILES = exports.DOMAIN_ORDER = exports.CONTROL_DEFS = exports.SoulScanner = void 0;
+var scanner_1 = require("./scanner");
+Object.defineProperty(exports, "SoulScanner", { enumerable: true, get: function () { return scanner_1.SoulScanner; } });
+Object.defineProperty(exports, "CONTROL_DEFS", { enumerable: true, get: function () { return scanner_1.CONTROL_DEFS; } });
+Object.defineProperty(exports, "DOMAIN_ORDER", { enumerable: true, get: function () { return scanner_1.DOMAIN_ORDER; } });
+Object.defineProperty(exports, "GOVERNANCE_FILES", { enumerable: true, get: function () { return scanner_1.GOVERNANCE_FILES; } });
+var templates_1 = require("./templates");
+Object.defineProperty(exports, "DOMAIN_TEMPLATES", { enumerable: true, get: function () { return templates_1.DOMAIN_TEMPLATES; } });
+//# sourceMappingURL=index.js.map

package/dist/soul/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/soul/index.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,qCAAsF;AAA7E,sGAAA,WAAW,OAAA;AAAE,uGAAA,YAAY,OAAA;AAAE,uGAAA,YAAY,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AASlE,yCAA+C;AAAtC,6GAAA,gBAAgB,OAAA"}

package/dist/soul/scanner.d.ts

@@ -0,0 +1,95 @@
+/**
+ * SOUL Scanner - Behavioral Governance Scanner
+ *
+ * Scans governance files (SOUL.md, system-prompt.md, etc.) for coverage
+ * across 8 behavioral governance domains defined in OASB v2.
+ */
+export type AgentTier = 'BASIC' | 'TOOL-USING' | 'AGENTIC' | 'MULTI-AGENT';
+export type SoulGrade = 'A' | 'B' | 'C' | 'D' | 'F';
+export interface ControlCheck {
+    id: string;
+    name: string;
+    domain: string;
+    keywords: string[];
+    passed: boolean;
+}
+export interface DomainResult {
+    domain: string;
+    domainId: number;
+    controls: ControlCheck[];
+    passed: number;
+    total: number;
+    percentage: number;
+}
+export interface SoulScanResult {
+    file: string | null;
+    fileSize: number;
+    agentTier: AgentTier;
+    domains: DomainResult[];
+    score: number;
+    grade: SoulGrade;
+    criticalFloor: boolean;
+    criticalMissing: string[];
+    totalControls: number;
+    totalPassed: number;
+}
+export interface HardenResult {
+    file: string;
+    sectionsAdded: string[];
+    controlsAdded: number;
+    dryRun: boolean;
+    content: string;
+    existedBefore: boolean;
+}
+declare const GOVERNANCE_FILES: string[];
+interface ControlDef {
+    id: string;
+    name: string;
+    domain: string;
+    domainId: number;
+    keywords: string[];
+    critical?: boolean;
+    /** Which tiers must satisfy this control. Empty means all tiers. */
+    tiers: AgentTier[];
+}
+declare const CONTROL_DEFS: ControlDef[];
+declare const DOMAIN_ORDER: string[];
+export declare class SoulScanner {
+    /**
+     * Find the governance file in a directory.
+     * Returns the first match from GOVERNANCE_FILES priority order, or null.
+     */
+    findGovernanceFile(targetDir: string): string | null;
+    /**
+     * Detect agent tier by scanning governance file content and project files.
+     */
+    detectTier(targetDir: string, governanceContent: string): AgentTier;
+    /**
+     * Check if content matches any keyword for a control.
+     * Case-insensitive substring match.
+     */
+    private checkControl;
+    /**
+     * Calculate grade from score, applying critical floor if needed.
+     */
+    private calculateGrade;
+    /**
+     * Return the subset of controls applicable to a given agent tier.
+     */
+    private applicableControls;
+    /**
+     * Scan a directory for behavioral governance coverage.
+     */
+    scanSoul(targetDir: string, options?: {
+        verbose?: boolean;
+        tier?: string;
+    }): Promise<SoulScanResult>;
+    /**
+     * Generate or update SOUL.md with missing governance sections.
+     */
+    hardenSoul(targetDir: string, options?: {
+        dryRun?: boolean;
+    }): Promise<HardenResult>;
+}
+export { CONTROL_DEFS, DOMAIN_ORDER, GOVERNANCE_FILES };
+//# sourceMappingURL=scanner.d.ts.map

package/dist/soul/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../src/soul/scanner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,YAAY,GAAG,SAAS,GAAG,aAAa,CAAC;AAE3E,MAAM,MAAM,SAAS,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;AAEpD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;IACjB,aAAa,EAAE,OAAO,CAAC;IACvB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;CACxB;AAMD,QAAA,MAAM,gBAAgB,UAWrB,CAAC;AAMF,UAAU,UAAU;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,oEAAoE;IACpE,KAAK,EAAE,SAAS,EAAE,CAAC;CACpB;AAOD,QAAA,MAAM,YAAY,EAAE,UAAU,EAoE7B,CAAC;AAGF,QAAA,MAAM,YAAY,UASjB,CAAC;AAgBF,qBAAa,WAAW;IACtB;;;OAGG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAUpD;;OAEG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,SAAS;IAiCnE;;;OAGG;IACH,OAAO,CAAC,YAAY;IAUpB;;OAEG;IACH,OAAO,CAAC,cAAc;IAgBtB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAI1B;;OAEG;IACG,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,CAAC;IAqG1G;;OAEG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC;CA6E3F;AAGD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,CAAC"}