hackmyagent 0.9.4 → 0.9.6

package/dist/cli.js

@@ -41,6 +41,29 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const commander_1 = require("commander");
 const index_1 = require("./index");
 const program = new commander_1.Command();
+// Write JSON to stdout synchronously with retry for pipe backpressure.
+// process.stdout.write() is async and gets truncated when process.exit()
+// runs before the stream flushes. fs.writeFileSync(1, ...) can fail with
+// EAGAIN on non-blocking pipes when the buffer (64KB on macOS) fills up.
+// This function writes in chunks with retry to handle both cases.
+function writeJsonStdout(data) {
+    const fs = require('fs');
+    const buf = Buffer.from(JSON.stringify(data, null, 2) + '\n');
+    let offset = 0;
+    while (offset < buf.length) {
+        try {
+            const written = fs.writeSync(1, buf, offset, buf.length - offset);
+            offset += written;
+        }
+        catch (e) {
+            if (e && typeof e === 'object' && 'code' in e && e.code === 'EAGAIN') {
+                // Pipe buffer full — spin-wait briefly then retry
+                continue;
+            }
+            throw e;
+        }
+    }
+}
 // Check for NO_COLOR env or non-TTY to disable colors by default
 const noColorEnv = process.env.NO_COLOR !== undefined || process.stdout.isTTY === false;
 // Color codes - will be cleared if --no-color is passed
@@ -50,14 +73,15 @@ let colors = {
     red: '\x1b[31m',
     brightRed: '\x1b[91m',
     cyan: '\x1b[36m',
+    dim: '\x1b[2m',
     reset: '\x1b[0m',
 };
 if (noColorEnv) {
-    colors = { green: '', yellow: '', red: '', brightRed: '', cyan: '', reset: '' };
+    colors = { green: '', yellow: '', red: '', brightRed: '', cyan: '', dim: '', reset: '' };
 }
 // Deprecation warning for removed HMAC auth
 if (process.env.HMA_COMMUNITY_SECRET) {
-    console.error('Warning: HMA_COMMUNITY_SECRET is deprecated and no longer used. Scan tokens are now issued automatically.');
+    console.error('Note: HMA_COMMUNITY_SECRET is deprecated and no longer used. Scan tokens are now issued automatically.');
 }
 program
     .name('hackmyagent')
@@ -85,15 +109,15 @@ Examples:
     .hook('preAction', (thisCommand) => {
     const opts = thisCommand.opts();
     if (opts.color === false) {
-        colors = { green: '', yellow: '', red: '', brightRed: '', cyan: '', reset: '' };
+        colors = { green: '', yellow: '', red: '', brightRed: '', cyan: '', dim: '', reset: '' };
     }
 });
 // Risk level colors and symbols
 const RISK_DISPLAY = {
-    low: { symbol: '✅', color: () => colors.green },
-    medium: { symbol: '⚠️', color: () => colors.yellow },
-    high: { symbol: '🔴', color: () => colors.red },
-    critical: { symbol: '🚨', color: () => colors.brightRed },
+    low: { symbol: '[+]', color: () => colors.green },
+    medium: { symbol: '[~]', color: () => colors.yellow },
+    high: { symbol: '[!]', color: () => colors.red },
+    critical: { symbol: '[!!]', color: () => colors.brightRed },
 };
 const RESET = () => colors.reset;
 program
@@ -122,7 +146,7 @@ Examples:
             skipDnsVerification: options.offline,
         });
         if (options.json) {
-            console.log(JSON.stringify(result, null, 2));
+            writeJsonStdout(result);
             return;
         }
         const risk = RISK_DISPLAY[result.risk];
@@ -130,19 +154,19 @@ Examples:
         // Publisher info
         console.log(`Publisher: @${result.publisher.name}`);
         if (result.publisher.verified) {
-            console.log(`├─ ✅ Verified via DNS`);
+            console.log(`├─ [+] Verified via DNS`);
             if (result.publisher.domain) {
-                console.log(`├─ 🌐 Domain: ${result.publisher.domain}`);
+                console.log(`├─ Domain: ${result.publisher.domain}`);
             }
             if (result.publisher.verifiedAt && options.verbose) {
-                console.log(`└─ 📅 Verified at: ${result.publisher.verifiedAt.toISOString()}`);
+                console.log(`└─ Verified at: ${result.publisher.verifiedAt.toISOString()}`);
             }
             else {
                 console.log(`└─ Method: DNS TXT record`);
             }
         }
         else {
-            console.log(`├─ ❌ Not verified`);
+            console.log(`├─ [-] Not verified`);
             if (result.publisher.failureReason && options.verbose) {
                 console.log(`└─ Reason: ${result.publisher.failureReason}`);
             }
@@ -161,13 +185,13 @@ Examples:
         }
         else {
             for (const perm of result.permissions.safe) {
-                console.log(`├─ ✅ ${perm}`);
+                console.log(`├─ [+] ${perm}`);
             }
             for (const perm of result.permissions.reviewNeeded) {
-                console.log(`├─ ⚠️  ${perm} (review needed)`);
+                console.log(`├─ [~] ${perm} (review needed)`);
             }
             for (const perm of result.permissions.dangerous) {
-                console.log(`├─ ❌ ${perm} (DANGEROUS)`);
+                console.log(`├─ [!] ${perm} (elevated risk)`);
             }
             console.log(`└─ Risk score: ${result.permissions.riskScore}/100`);
         }
@@ -175,10 +199,10 @@ Examples:
         // Revocation
         console.log('Revocation:');
         if (result.revocation.revoked) {
-            console.log(`└─ 🚨 REVOKED: ${result.revocation.reason}`);
+            console.log(`└─ [!!] Revoked: ${result.revocation.reason}`);
         }
         else {
-            console.log(`└─ ✅ Not on blocklist`);
+            console.log(`└─ [+] Not on blocklist`);
         }
         console.log();
         // Verbose details
@@ -198,10 +222,10 @@ Examples:
 });
 // Severity colors and symbols for secure command
 const SEVERITY_DISPLAY = {
-    critical: { symbol: '🔴', color: () => colors.brightRed },
-    high: { symbol: '🟠', color: () => colors.red },
-    medium: { symbol: '🟡', color: () => colors.yellow },
-    low: { symbol: '🟢', color: () => colors.green },
+    critical: { symbol: '[!!]', color: () => colors.brightRed },
+    high: { symbol: '[!]', color: () => colors.red },
+    medium: { symbol: '[~]', color: () => colors.yellow },
+    low: { symbol: '[.]', color: () => colors.green },
 };
 function groupFindingsBySeverity(findings) {
     const grouped = {
@@ -316,7 +340,7 @@ function generateBenchmarkReport(findings, level, categoryFilter) {
     const l3Compliance = l3Total > 0 ? Math.round((l3Passed / l3Total) * 100) : 100;
     const totalScored = l1Total + l2Total + l3Total;
     const totalPassed = l1Passed + l2Passed + l3Passed;
-    const overallCompliance = totalScored > 0 ? Math.round((totalPassed / totalScored) * 100) : 100;
+    const overallCompliance = totalScored > 0 ? Math.round((totalPassed / totalScored) * 100) : 0;
     // Group results by category
     const categoryResults = [];
     for (const category of index_1.OASB_1_CATEGORIES) {
@@ -328,7 +352,7 @@ function generateBenchmarkReport(findings, level, categoryFilter) {
         const passed = catControls.filter((r) => r.status === 'passed').length;
         const failed = catControls.filter((r) => r.status === 'failed').length;
         const unverified = catControls.filter((r) => r.status === 'unverified').length;
-        const compliance = (passed + failed) > 0 ? Math.round((passed / (passed + failed)) * 100) : 100;
+        const compliance = (passed + failed) > 0 ? Math.round((passed / (passed + failed)) * 100) : 0;
         categoryResults.push({
             category: category.name,
             compliance,
@@ -442,14 +466,14 @@ function generateHtmlReport(result) {
         'Compliant': '#22c55e',
         'Passing': '#eab308',
         'Needs Improvement': '#f97316',
-        'Failing': '#ef4444',
+        'Not Passing': '#ef4444',
     }[result.rating] || '#94a3b8';
     const ratingBg = {
         'Certified': 'rgba(34, 197, 94, 0.15)',
         'Compliant': 'rgba(34, 197, 94, 0.15)',
         'Passing': 'rgba(234, 179, 8, 0.15)',
         'Needs Improvement': 'rgba(249, 115, 22, 0.15)',
-        'Failing': 'rgba(239, 68, 68, 0.15)',
+        'Not Passing': 'rgba(239, 68, 68, 0.15)',
     }[result.rating] || 'rgba(148, 163, 184, 0.15)';
     // Generate donut chart SVG
     const donutRadius = 70;
@@ -1390,10 +1414,10 @@ function printBenchmarkReport(result, verbose) {
         'Compliant': colors.green,
         'Passing': colors.yellow,
         'Needs Improvement': colors.yellow,
-        'Failing': colors.red,
+        'Not Passing': colors.red,
     };
     // Header
-    console.log(`\n📋 ${result.benchmark} v${result.version}`);
+    console.log(`\n${result.benchmark} v${result.version}`);
     console.log(`━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`);
     // Level and rating
     const levelNames = {
@@ -1411,13 +1435,18 @@ function printBenchmarkReport(result, verbose) {
     // Category breakdown
     console.log(`Categories:`);
     for (const catResult of result.categories) {
-        const statusIcon = catResult.failed === 0 ? '✅' : (catResult.passed > 0 ? '🟡' : '❌');
-        console.log(`  ${statusIcon} ${catResult.category}: ${catResult.passed}/${catResult.passed + catResult.failed} (${catResult.compliance}%)`);
+        const total = catResult.passed + catResult.failed;
+        if (total === 0) {
+            console.log(`  [.] ${catResult.category}: N/A (no controls at this level)`);
+            continue;
+        }
+        const statusIcon = catResult.failed === 0 ? '[+]' : (catResult.passed > 0 ? '[~]' : '[-]');
+        console.log(`  ${statusIcon} ${catResult.category}: ${catResult.passed}/${total} (${catResult.compliance}%)`);
         // Show failed controls
         if (verbose || catResult.failed > 0) {
             for (const ctrl of catResult.controls) {
                 if (ctrl.status === 'failed') {
-                    console.log(`     ❌ ${ctrl.controlId}: ${ctrl.name}`);
+                    console.log(`     [-] ${ctrl.controlId}: ${ctrl.name}`);
                     if (verbose) {
                         for (const finding of ctrl.findings) {
                             console.log(`        └─ ${finding}`);
@@ -1425,7 +1454,7 @@ function printBenchmarkReport(result, verbose) {
                     }
                 }
                 else if (verbose && ctrl.status === 'passed') {
-                    console.log(`     ✅ ${ctrl.controlId}: ${ctrl.name}`);
+                    console.log(`     [+] ${ctrl.controlId}: ${ctrl.name}`);
                 }
                 else if (verbose && ctrl.status === 'unverified') {
                     // Look up the original control to determine why it's unverified
@@ -1435,7 +1464,7 @@ function printBenchmarkReport(result, verbose) {
                     const reason = originalControl && (originalControl.verification === 'manual' || originalControl.verification === 'forward')
                         ? 'manual/forward'
                         : 'no scanner data';
-                    console.log(`     ⚪ ${ctrl.controlId}: ${ctrl.name} (${reason})`);
+                    console.log(`     [?] ${ctrl.controlId}: ${ctrl.name} (${reason})`);
                 }
             }
         }
@@ -1445,7 +1474,7 @@ function printBenchmarkReport(result, verbose) {
     // Compliance breakdown by level
     if (verbose) {
         console.log(`\nCompliance by level: L1=${result.l1Compliance}% L2=${result.l2Compliance}% L3=${result.l3Compliance}%`);
-        console.log(`Legend: ⚪ = Manual/Forward verification required`);
+        console.log(`Legend: [?] = Manual/Forward verification required`);
     }
     // Show appropriate next step based on current level
     if (result.level === 'L1') {
@@ -1472,9 +1501,12 @@ function resolvePackageName(targetDir) {
         }
     }
     catch { /* ignore */ }
-    // Fallback: use directory name
+    // Fallback: use directory name, resolving "." to the actual directory name
     const path = require('path');
-    return path.basename(targetDir);
+    const resolved = path.resolve(targetDir);
+    const name = path.basename(resolved);
+    // Skip names that are clearly not package names
+    return name && name !== '.' && name !== '..' ? name : null;
 }
 function resolvePackageVersion(targetDir) {
     try {
@@ -1513,7 +1545,6 @@ Output formats (--format):
   json   Machine-readable JSON
   sarif  GitHub Security tab / IDE integration
   html   Shareable compliance report
-  asp    Agent Security Profile (our format)
 
 Severities: critical, high, medium, low
 Exit code 1 if critical/high issues found (or non-compliant in benchmark mode).
@@ -1533,7 +1564,7 @@ Examples:
     .option('--dry-run', 'Preview fixes without applying them (use with --fix)')
     .option('--ignore <checks>', 'Comma-separated check IDs to skip (e.g., CRED-001,GIT-002)')
     .option('--json', 'Output as JSON (deprecated: use --format json)')
-    .option('-f, --format <format>', 'Output format: text, json, sarif, html, asp (default: text)', 'text')
+    .option('-f, --format <format>', 'Output format: text, json, sarif, html (default: text)', 'text')
     .option('-o, --output <file>', 'Write output to file instead of stdout')
     .option('--fail-below <percent>', 'Exit 1 if compliance below threshold (0-100)')
     .option('-v, --verbose', 'Show all checks including passed ones')
@@ -1587,10 +1618,10 @@ Examples:
         // Only show progress for text output
         if (format === 'text') {
             if (options.dryRun) {
-                console.log(`\n🔍 Scanning ${targetDir} (dry-run)...\n`);
+                console.log(`\nScanning ${targetDir} (dry-run)...\n`);
             }
             else {
-                console.log(`\n🔍 Scanning ${targetDir}...\n`);
+                console.log(`\nScanning ${targetDir}...\n`);
             }
         }
         // Deep mode progress display
@@ -1624,7 +1655,7 @@ Examples:
             const govScore = govResult.score;
             const compositeScore = Math.round((infraScore + govScore) / 2);
             if (format === 'json') {
-                console.log(JSON.stringify({
+                const jsonOutput = JSON.stringify({
                     benchmark: 'OASB-2',
                     infraScore,
                     govScore,
@@ -1632,7 +1663,15 @@ Examples:
                     conformance: govResult.conformance,
                     infraResult,
                     govResult,
-                }, null, 2));
+                }, null, 2);
+                if (options.output) {
+                    require('fs').writeFileSync(options.output, jsonOutput);
+                    console.error(`Report written to ${options.output}`);
+                }
+                else {
+                    const fs = require('fs');
+                    fs.writeFileSync(1, jsonOutput + '\n');
+                }
             }
             else {
                 process.stdout.write('\nOASB v2 Composite Security Assessment\n');
@@ -1700,13 +1739,22 @@ Examples:
                 process.exit(1);
             }
             // Exit with non-zero if failing or needs improvement (default behavior)
-            if (failBelow === undefined && (benchmarkResult.rating === 'Failing' || benchmarkResult.rating === 'Needs Improvement')) {
+            if (failBelow === undefined && (benchmarkResult.rating === 'Not Passing' || benchmarkResult.rating === 'Needs Improvement')) {
                 process.exit(1);
             }
             return;
         }
         if (format === 'json') {
-            console.log(JSON.stringify(result, null, 2));
+            if (options.output) {
+                require('fs').writeFileSync(options.output, JSON.stringify(result, null, 2) + '\n');
+                console.error(`Report written to ${options.output}`);
+            }
+            else {
+                writeJsonStdout(result);
+            }
+            const critHigh = result.findings.filter((f) => !f.passed && !f.fixed && (f.severity === 'critical' || f.severity === 'high'));
+            if (critHigh.length > 0)
+                process.exitCode = 1;
             return;
         }
         // Handle SARIF/HTML/ASP for non-benchmark mode
@@ -1763,7 +1811,12 @@ Examples:
                     scoreExtra += ` (${sa.cachedResults} cached)`;
             }
         }
-        console.log(`${projectTypeLabel} | Score: ${result.score}/${result.maxScore}${scoreExtra}\n`);
+        console.log(`${projectTypeLabel} | Score: ${result.score}/${result.maxScore}${scoreExtra}`);
+        if (issues.length > 0) {
+            const recoverable = Math.min(result.maxScore - result.score, result.maxScore);
+            console.log(`  Path forward: +${recoverable} recoverable by addressing ${issues.length} issue${issues.length === 1 ? '' : 's'}`);
+        }
+        console.log('');
         // No issues? Say so and exit
         if (issues.length === 0 && fixedFindings.length === 0) {
             console.log(`${colors.green}No issues found.${RESET()}\n`);
@@ -1786,8 +1839,39 @@ Examples:
                 if (finding.fix) {
                     console.log(`       ${colors.cyan}Fix:${RESET()} ${finding.fix}`);
                 }
+                if (options.verbose) {
+                    console.log(`       ${colors.dim}Check: ${finding.checkId} | Category: ${finding.category}${RESET()}`);
+                    if (finding.file) {
+                        console.log(`       ${colors.dim}File: ${finding.file}${finding.line ? ` (line ${finding.line})` : ''}${RESET()}`);
+                    }
+                    if (finding.message && finding.message !== finding.description) {
+                        console.log(`       ${colors.dim}Detail: ${finding.message}${RESET()}`);
+                    }
+                    if (finding.details && Object.keys(finding.details).length > 0) {
+                        for (const [key, value] of Object.entries(finding.details)) {
+                            console.log(`       ${colors.dim}${key}: ${typeof value === 'object' ? JSON.stringify(value) : value}${RESET()}`);
+                        }
+                    }
+                }
                 console.log();
             }
+            // Severity breakdown summary
+            const severityCounts = { critical: 0, high: 0, medium: 0, low: 0 };
+            for (const f of issues) {
+                severityCounts[f.severity]++;
+            }
+            const summaryParts = [];
+            if (severityCounts.critical > 0)
+                summaryParts.push(`${colors.brightRed}Critical: ${severityCounts.critical}${RESET()}`);
+            if (severityCounts.high > 0)
+                summaryParts.push(`${colors.red}High: ${severityCounts.high}${RESET()}`);
+            if (severityCounts.medium > 0)
+                summaryParts.push(`${colors.yellow}Medium: ${severityCounts.medium}${RESET()}`);
+            if (severityCounts.low > 0)
+                summaryParts.push(`${colors.green}Low: ${severityCounts.low}${RESET()}`);
+            if (summaryParts.length > 0) {
+                console.log(`${summaryParts.join(' | ')}\n`);
+            }
         }
         // Print fixed findings
         if (fixedFindings.length > 0) {
@@ -1802,9 +1886,9 @@ Examples:
                 console.log(`Undo: hackmyagent rollback ${directory}\n`);
             }
         }
-        // Registry reporting: auto-publish to community endpoint by default
-        const shouldReport = options.registryReport || (options.registry !== false);
-        if (shouldReport) {
+        // Registry reporting: only when explicitly requested via --version-id (CI) or --registry-report
+        // Community contributions are handled by the opena2a CLI wrapper, not HMA directly
+        if (options.versionId || options.registryReport) {
             try {
                 const core = await Promise.resolve().then(() => __importStar(require('./index')));
                 const registryUrl = options.registryUrl || process.env.REGISTRY_URL || 'https://registry.opena2a.org';
@@ -1841,8 +1925,8 @@ Examples:
                     }
                 }
             }
-            catch (reportErr) {
-                console.error(`Registry: failed to report scan results: ${reportErr.message || reportErr}`);
+            catch (_reportErr) {
+                // Silently ignore registry errors - they are not relevant to local scan results
             }
         }
         // Star prompt (interactive TTY only, text format only)
@@ -1862,10 +1946,10 @@ Examples:
 });
 // Severity display for external scan findings
 const FINDING_SEVERITY_DISPLAY = {
-    critical: { symbol: '🔴', color: () => colors.brightRed },
-    high: { symbol: '🟠', color: () => colors.red },
-    medium: { symbol: '🟡', color: () => colors.yellow },
-    low: { symbol: '🟢', color: () => colors.green },
+    critical: { symbol: '[!!]', color: () => colors.brightRed },
+    high: { symbol: '[!]', color: () => colors.red },
+    medium: { symbol: '[~]', color: () => colors.yellow },
+    low: { symbol: '[.]', color: () => colors.green },
 };
 function groupExternalFindingsBySeverity(findings) {
     const grouped = {
@@ -1916,29 +2000,36 @@ function assessRiskLevel(findings) {
     const mediumCount = findings.filter((f) => f.severity === 'medium').length;
     if (criticalCount > 0) {
         return {
-            level: 'CRITICAL',
+            level: 'Critical',
             color: colors.brightRed,
-            description: 'Immediate action required. Your OpenClaw installation has critical vulnerabilities.',
+            description: `${criticalCount} critical finding(s) with recommended fixes available.`,
         };
     }
     if (highCount > 0) {
         return {
-            level: 'HIGH',
+            level: 'High',
             color: colors.red,
-            description: 'Significant risks detected. Address high-severity issues promptly.',
+            description: `${highCount} high-severity finding(s) detected. Fixes available below.`,
         };
     }
     if (mediumCount > 0) {
         return {
-            level: 'MODERATE',
+            level: 'Moderate',
             color: colors.yellow,
-            description: 'Some issues found. Review and address when possible.',
+            description: 'Some findings detected. Review the recommendations below.',
+        };
+    }
+    if (findings.length === 0) {
+        return {
+            level: 'None',
+            color: colors.dim,
+            description: 'No OpenClaw configuration detected. Run `hackmyagent secure` for a full scan.',
         };
     }
     return {
-        level: 'LOW',
+        level: 'Low',
         color: colors.green,
-        description: 'Your OpenClaw installation appears well-secured.',
+        description: 'No critical or high findings detected.',
     };
 }
 program
@@ -1969,13 +2060,13 @@ Examples:
     try {
         const targetDir = detectOpenClawDirectory(directory);
         if (!options.json) {
-            console.log(`\n🦞 OpenClaw Security Report`);
+            console.log(`\nOpenClaw Security Report`);
             console.log(`━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`);
             if (options.dryRun) {
-                console.log(`🔍 Scanning ${targetDir} (dry-run - previewing fixes)...\n`);
+                console.log(`Scanning ${targetDir} (dry-run - previewing fixes)...\n`);
             }
             else if (options.fix) {
-                console.log(`🔧 Scanning and fixing ${targetDir}...\n`);
+                console.log(`Scanning and fixing ${targetDir}...\n`);
                 console.log(`${colors.yellow}Auto-fix will:${RESET()}`);
                 console.log(`  • Bind gateway to 127.0.0.1 (local-only)`);
                 console.log(`  • Replace plaintext tokens with env var references`);
@@ -1984,7 +2075,7 @@ Examples:
                 console.log(`\n${colors.cyan}A backup will be created for rollback if needed.${RESET()}\n`);
             }
             else {
-                console.log(`🔍 Scanning ${targetDir}...\n`);
+                console.log(`Scanning ${targetDir}...\n`);
             }
         }
         const scanner = new index_1.HardeningScanner();
@@ -2009,7 +2100,7 @@ Examples:
                 passed: passedFindings.length,
                 findings: allOpenClawFindings,
             };
-            console.log(JSON.stringify(jsonOutput, null, 2));
+            writeJsonStdout(jsonOutput);
             return;
         }
         // Risk assessment
@@ -2020,7 +2111,7 @@ Examples:
         console.log(`Checks: ${allOpenClawFindings.length} total | ${issues.length} issues | ${fixedFindings.length} fixed | ${passedFindings.length} passed\n`);
         // Show issues
         if (issues.length > 0) {
-            console.log(`${colors.red}Issues Found:${RESET()}\n`);
+            console.log(`${colors.red}Findings:${RESET()}\n`);
             for (const finding of issues) {
                 const display = SEVERITY_DISPLAY[finding.severity];
                 const location = finding.file
@@ -2028,13 +2119,14 @@ Examples:
                         ? `${finding.file}:${finding.line}`
                         : finding.file
                     : '';
-                console.log(`${display.color()}${display.symbol} [${finding.checkId}] ${finding.severity.toUpperCase()}${RESET()}`);
+                const sevLabel = finding.severity.charAt(0).toUpperCase() + finding.severity.slice(1);
+                console.log(`${display.color()}${display.symbol} [${finding.checkId}] ${sevLabel}${RESET()}`);
                 console.log(`   ${finding.description}`);
                 if (location) {
                     console.log(`   File: ${location}`);
                 }
                 if (finding.fix) {
-                    console.log(`   ${colors.cyan}Fix:${RESET()} ${finding.fix}`);
+                    console.log(`   ${colors.cyan}Recommended fix:${RESET()} ${finding.fix}`);
                 }
                 console.log();
             }
@@ -2044,7 +2136,7 @@ Examples:
         }
         // Show fixed findings
         if (fixedFindings.length > 0) {
-            console.log(`${colors.green}✅ Auto-Remediation Applied:${RESET()}\n`);
+            console.log(`${colors.green}Auto-Remediation Applied:${RESET()}\n`);
             for (const finding of fixedFindings) {
                 console.log(`  ${colors.green}✓${RESET()} [${finding.checkId}] ${finding.name}`);
                 if (finding.fixMessage) {
@@ -2053,8 +2145,8 @@ Examples:
             }
             console.log();
             if (result.backupPath) {
-                console.log(`${colors.yellow}📁 Backup created:${RESET()} ${result.backupPath}`);
-                console.log(`${colors.yellow}↩️  To rollback:${RESET()} hackmyagent rollback ${targetDir}`);
+                console.log(`${colors.yellow}Backup created:${RESET()} ${result.backupPath}`);
+                console.log(`${colors.yellow}To rollback:${RESET()} hackmyagent rollback ${targetDir}`);
                 console.log();
                 console.log(`${colors.cyan}Note:${RESET()} If you replaced tokens with env vars, set OPENCLAW_AUTH_TOKEN`);
                 console.log(`      in your environment before starting OpenClaw.\n`);
@@ -2091,7 +2183,7 @@ Detects externally exposed:
   • API keys in responses
   • Debug/admin interfaces
 
-Scoring: A (90-100), B (80-89), C (70-79), D (60-69), F (<60)
+Scoring: A (90-100), B (80-89), C (70-79), D (60-69), Needs Improvement (<60)
 Exit code 1 if critical/high issues found.
 
 Examples:
@@ -2106,7 +2198,7 @@ Examples:
     .option('-v, --verbose', 'Show detailed finding information')
     .action(async (target, options) => {
     try {
-        console.log(`\n🔍 Scanning ${target}...\n`);
+        console.log(`\nScanning ${target}...\n`);
         const scanner = new index_1.ExternalScanner();
         const customPorts = options.ports
             ? options.ports.split(',').map((p) => parseInt(p.trim(), 10))
@@ -2116,7 +2208,7 @@ Examples:
             timeout: parseInt(options.timeout ?? '5000', 10),
         });
         if (options.json) {
-            console.log(JSON.stringify(result, null, 2));
+            writeJsonStdout(result);
             return;
         }
         // Print header
@@ -2132,7 +2224,7 @@ Examples:
         console.log(`Open Ports: ${result.openPorts.length > 0 ? result.openPorts.join(', ') : 'None detected'}`);
         console.log(`Duration: ${result.duration}ms\n`);
         if (result.findings.length === 0) {
-            console.log(`${colors.green}✅ No security issues found!${RESET()}\n`);
+            console.log(`${colors.green}[+] No security issues found!${RESET()}\n`);
             return;
         }
         // Group findings by severity
@@ -2183,10 +2275,10 @@ Examples:
     .action(async (directory) => {
     try {
         const targetDir = directory.startsWith('/') ? directory : process.cwd() + '/' + directory;
-        console.log(`\n🔄 Rolling back changes in ${targetDir}...\n`);
+        console.log(`\nRolling back changes in ${targetDir}...\n`);
         const scanner = new index_1.HardeningScanner();
         await scanner.rollback(targetDir);
-        console.log(`${colors.green}✅ Rollback successful!${RESET()}`);
+        console.log(`${colors.green}[+] Rollback successful!${RESET()}`);
         console.log('   All auto-fix changes have been reverted.\n');
     }
     catch (error) {
@@ -2220,12 +2312,6 @@ Target types:
   a2a         A2A agent messaging endpoint (/a2a/message)
   local       Local simulation (no API calls)
 
-Target types:
-  api         OpenAI/Anthropic chat completions (default)
-  mcp         MCP JSON-RPC server (tools/call, tools/list)
-  a2a         A2A agent messaging endpoint (/a2a/message)
-  local       Local simulation (no API calls)
-
 Examples:
   $ hackmyagent attack https://api.example.com/v1/chat
   $ hackmyagent attack https://api.example.com --intensity aggressive
@@ -2253,6 +2339,7 @@ Examples:
     .option('--stop-on-success', 'Stop after first successful attack')
     .option('--payload-file <path>', 'JSON file with custom attack payloads')
     .option('--fail-on-vulnerable [severity]', 'Exit code 1 if vulnerabilities found (optional: critical/high/medium/low)')
+    .option('--json', 'Output as JSON (shorthand for --format json)')
     .option('-f, --format <format>', 'Output format: text, json, sarif, html', 'text')
     .option('-o, --output <file>', 'Write output to file')
     .option('-v, --verbose', 'Show detailed output for each payload')
@@ -2319,9 +2406,20 @@ Examples:
             apiFormat = 'a2a';
         }
         // Build target
+        // When --local is used, treat the argument as a directory path, not a URL
+        let localPath;
+        if (targetType === 'local' && targetUrl) {
+            const path = require('path');
+            const fs = require('fs');
+            const resolved = path.resolve(targetUrl);
+            if (fs.existsSync(resolved) && fs.statSync(resolved).isDirectory()) {
+                localPath = resolved;
+            }
+        }
         const target = {
-            url: targetUrl || '',
+            url: localPath ? '' : (targetUrl || ''),
             type: targetType,
+            localPath,
             headers: Object.keys(headers).length > 0 ? headers : undefined,
             apiFormat: apiFormat,
             model: options.model,
@@ -2330,9 +2428,9 @@ Examples:
             a2aSender: options.a2aSender,
             a2aRecipient: options.a2aRecipient,
         };
-        // Validate format
+        // Validate format (--json is shorthand for --format json)
         const validFormats = ['text', 'json', 'sarif', 'html'];
-        const format = options.format || 'text';
+        const format = options.json ? 'json' : (options.format || 'text');
         if (!validFormats.includes(format)) {
             console.error(`Error: Invalid format '${format}'. Use: ${validFormats.join(', ')}`);
             process.exit(1);
@@ -2350,9 +2448,9 @@ Examples:
         }
         // Show header for text output
         if (format === 'text') {
-            console.log(`\n⚔️  HackMyAgent Attack Mode`);
+            console.log(`\nHackMyAgent Attack Mode`);
             console.log(`━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`);
-            console.log(`Target: ${target.type === 'local' ? 'Local Simulation' : targetUrl}`);
+            console.log(`Target: ${target.type === 'local' ? (localPath ? `Local Directory: ${localPath}` : 'Local Simulation') : targetUrl}`);
             console.log(`Intensity: ${intensity}`);
             if (customPayloads) {
                 console.log(`Payloads: ${customPayloads.length} custom (from file)`);
@@ -2399,8 +2497,8 @@ Examples:
                 console.log(output);
             }
         }
-        // Registry reporting: auto-publish to community endpoint by default
-        const shouldReport = options.registryReport || (options.registry !== false);
+        // Registry reporting: only when explicitly requested via --version-id (CI) or --registry-report
+        const shouldReport = targetType !== 'local' && (options.versionId || options.registryReport);
         if (shouldReport) {
             try {
                 const core = await Promise.resolve().then(() => __importStar(require('./index')));
@@ -2433,8 +2531,8 @@ Examples:
                     }
                 }
             }
-            catch (reportErr) {
-                console.error(`Registry: failed to report scan results: ${reportErr.message || reportErr}`);
+            catch (_reportErr) {
+                // Silently ignore registry errors - they are not relevant to local scan results
             }
         }
         // Exit with non-zero based on fail policy
@@ -2469,7 +2567,7 @@ function printAttackReport(report, verbose) {
         if (stats.total === 0)
             continue;
         const catInfo = index_1.ATTACK_CATEGORIES[cat];
-        const icon = stats.successful > 0 ? '❌' : '✅';
+        const icon = stats.successful > 0 ? '[-]' : '[+]';
         console.log(`  ${icon} ${catInfo.name}: ${stats.successful}/${stats.total} successful`);
     }
     console.log();
@@ -2495,14 +2593,28 @@ function printAttackReport(report, verbose) {
         if (blocked.length > 0) {
             console.log(`${colors.green}Blocked Attacks (${blocked.length}):${RESET()}`);
             for (const r of blocked) {
-                console.log(`  ✅ ${r.payload.id}: ${r.payload.name}`);
+                console.log(`  [+] ${r.payload.id}: ${r.payload.name}`);
             }
             console.log();
         }
     }
     console.log(`━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━`);
-    console.log(`\nUse --verbose for detailed attack results.`);
-    console.log(`Use --intensity aggressive for advanced attacks.\n`);
+    // Inconclusive explanation (when there are inconclusive results)
+    if (report.summary.inconclusive > 0) {
+        console.log(`Note: ${report.summary.inconclusive} result(s) were inconclusive -- no clear success or block`);
+        console.log(`indicators matched the simulated response.`);
+        if (report.targetType === 'local') {
+            console.log(`Run against a live endpoint (without --local) for active testing with real responses.`);
+        }
+        console.log();
+    }
+    if (!verbose) {
+        console.log(`\nUse --verbose for detailed attack results.`);
+    }
+    if (report.intensity !== 'aggressive') {
+        console.log(`Use --intensity aggressive for advanced attacks.`);
+    }
+    console.log();
 }
 // Generate SARIF output for attack results
 function generateAttackSarif(report) {
@@ -3460,7 +3572,7 @@ Examples:
                     remediations: r.remediations,
                 })),
             };
-            console.log(JSON.stringify(jsonOutput, null, 2));
+            writeJsonStdout(jsonOutput);
             if (pluginErrors > 0)
                 process.exit(2);
             return;
@@ -3510,7 +3622,7 @@ Examples:
         console.log(`Run 'hackmyagent secure' for a full hardening scan.\n`);
         // Warn if scan is incomplete due to plugin errors
         if (pluginErrors > 0) {
-            console.log(`\n${colors.brightRed}[!!] WARNING: ${pluginErrors} plugin(s) failed — scan results are incomplete${RESET()}`);
+            console.log(`\n${colors.brightRed}[!!] Note: ${pluginErrors} plugin(s) failed -- scan results are incomplete${RESET()}`);
             console.log(`     Re-run with --verbose for details.\n`);
         }
         // Exit with non-zero if critical/high issues remain or scan is incomplete
@@ -3591,6 +3703,35 @@ function gradeColor(grade) {
         case 'F': return colors.brightRed;
     }
 }
+function levelColor(level) {
+    switch (level) {
+        case 'hardened': return colors.green;
+        case 'standard': return colors.green;
+        case 'developing': return colors.yellow;
+        case 'initial': return colors.cyan;
+        case 'not-started': return colors.reset;
+    }
+}
+function levelLabel(level) {
+    switch (level) {
+        case 'hardened': return 'Hardened';
+        case 'standard': return 'Standard';
+        case 'developing': return 'Developing';
+        case 'initial': return 'Initial';
+        case 'not-started': return 'Not Started';
+    }
+}
+/**
+ * Detect how the CLI was invoked to suggest correct command prefix.
+ */
+function getCommandPrefix() {
+    const execPath = process.argv[1] || '';
+    if (execPath.includes('npx') || execPath.includes('.npm/_npx') ||
+        execPath.includes('node_modules/.bin')) {
+        return 'npx hackmyagent';
+    }
+    return 'hackmyagent';
+}
 // Domain percentage bar for text output
 function domainBar(pct) {
     if (pct >= 80)
@@ -3606,38 +3747,36 @@ program
     .description(`Scan behavioral governance coverage
 
 Analyzes SOUL.md (or equivalent governance file) for coverage
-across 8 behavioral governance domains with 68 security controls.
+across 9 behavioral governance domains with 72 security controls.
 
 Searches for governance files in priority order:
   SOUL.md > system-prompt.md > SYSTEM_PROMPT.md > .cursorrules
   > .github/copilot-instructions.md > CLAUDE.md > .clinerules
   > instructions.md > constitution.md > agent-config.yaml
 
-Domains checked (OASB v2):
-  7. Trust Hierarchy         8. Capability Boundaries
-  9. Injection Hardening    10. Data Handling
-  11. Hardcoded Behaviors   12. Agentic Safety
-  13. Honesty & Transparency 14. Human Oversight
+Agent profiles filter domains by agent purpose:
+  conversational:  Injection, Hardcoded, Honesty, Harm Avoidance
+  code-assistant:  + Trust, Data
+  tool-agent:      + Capability, Oversight
+  autonomous:      + Agentic Safety
+  orchestrator:    All 9 domains
 
-Grade: A (80-100), B (60-79), C (40-59), D (20-39), F (0-19)
-Critical floor: Missing SOUL-IH-003 or SOUL-HB-001 caps grade at C.
-
-Conformance levels:
-  none:      one or more critical controls missing
-  essential: all critical controls pass, score < 60
-  standard:  all critical controls pass, score >= 60
-  hardened:  all critical controls pass, score >= 75
+Maturity levels:
+  Hardened (80+), Standard (60-79), Developing (40-59),
+  Initial (1-39), Not Started (0)
 
 Examples:
   $ hackmyagent scan-soul                    Scan current directory
   $ hackmyagent scan-soul ./my-agent         Scan specific directory
   $ hackmyagent scan-soul --json             Machine-readable output
   $ hackmyagent scan-soul --verbose          Show all controls
+  $ hackmyagent scan-soul --profile conversational  Override profile
   $ hackmyagent scan-soul --deep             Enable LLM semantic analysis`)
     .argument('[directory]', 'Directory to scan (defaults to current directory)', '.')
     .option('--json', 'Output as JSON')
     .option('-v, --verbose', 'Show individual control results')
     .option('--tier <tier>', 'Override agent tier detection (BASIC, TOOL-USING, AGENTIC, MULTI-AGENT)')
+    .option('--profile <profile>', 'Override agent profile (conversational, code-assistant, tool-agent, autonomous, orchestrator, custom)')
     .option('--fail-below <score>', 'Exit 1 if score below threshold (0-100)')
     .option('--deep', 'Enable LLM semantic analysis for ambiguous controls (requires claude CLI or ANTHROPIC_API_KEY)')
     .action(async (directory, options) => {
@@ -3647,15 +3786,17 @@ Examples:
             process.stderr.write(`Error: Directory '${targetDir}' does not exist.\n`);
             process.exit(1);
         }
+        const prefix = getCommandPrefix();
         const scanner = new index_1.SoulScanner();
         const result = await scanner.scanSoul(targetDir, {
             verbose: options.verbose,
             tier: options.tier,
+            profile: options.profile,
             deepAnalysis: options.deep,
         });
         // JSON output
         if (options.json) {
-            process.stdout.write(JSON.stringify(result, null, 2) + '\n');
+            writeJsonStdout(result);
             // Check fail threshold
             if (options.failBelow) {
                 const threshold = parseInt(options.failBelow, 10);
@@ -3676,9 +3817,27 @@ Examples:
             process.stdout.write(`  Searched: ${['SOUL.md', 'system-prompt.md', 'CLAUDE.md', '...'].join(', ')}\n`);
         }
         const tierLabel = result.tierForced ? `${result.agentTier} (--tier flag)` : `${result.agentTier} (auto-detected)`;
-        process.stdout.write(`Agent Tier: ${tierLabel}\n\n`);
+        const profileLabel = result.profileForced ? `${result.agentProfile} (--profile flag)` : `${result.agentProfile} (auto-detected)`;
+        process.stdout.write(`Agent Tier: ${tierLabel}\n`);
+        process.stdout.write(`Agent Profile: ${profileLabel}\n`);
+        if (result.skippedDomains.length > 0) {
+            process.stdout.write(`Skipped Domains: ${result.skippedDomains.join(', ')}\n`);
+        }
+        process.stdout.write('\n');
         process.stdout.write('Domain Scores:\n');
         for (const domain of result.domains) {
+            if (domain.skippedByProfile) {
+                if (options.verbose) {
+                    const label = (domain.domain + ':').padEnd(26);
+                    process.stdout.write(`  ${label}${colors.reset}--  (skipped by profile)${colors.reset}\n`);
+                }
+                continue;
+            }
+            if (domain.skippedByTier) {
+                const label = (domain.domain + ':').padEnd(26);
+                process.stdout.write(`  ${label}${colors.reset}--  (not applicable at ${result.agentTier} tier)${colors.reset}\n`);
+                continue;
+            }
             const pctColor = domainBar(domain.percentage);
             const label = (domain.domain + ':').padEnd(26);
             process.stdout.write(`  ${label}${pctColor}${domain.passed}/${domain.total}  (${domain.percentage}%)${colors.reset}\n`);
@@ -3693,9 +3852,9 @@ Examples:
             }
         }
         process.stdout.write('\n');
-        // Score and grade
-        const gc = gradeColor(result.grade);
-        process.stdout.write(`Governance Score: ${gc}${result.score}/100 (Grade: ${result.grade})${colors.reset}\n`);
+        // Score and level (progress-oriented)
+        const lc = levelColor(result.level);
+        process.stdout.write(`Governance Score: ${lc}${result.score}/100 [${levelLabel(result.level)}]${colors.reset}\n`);
         // Conformance level
         if (result.conformance === 'none') {
             process.stdout.write(`Conformance: ${colors.red}NONE${colors.reset} -- critical control missing (${result.criticalMissing.join(', ')})\n`);
@@ -3714,11 +3873,12 @@ Examples:
             const llmUpgraded = result.deepAnalysisResults.filter((e) => e.llmPassed).length;
             process.stdout.write(`Deep Analysis: ${llmUpgraded} control${llmUpgraded === 1 ? '' : 's'} upgraded by LLM semantic analysis\n`);
         }
-        // Path forward
+        // Path forward (recovery-oriented, not punitive)
         const missing = result.totalControls - result.totalPassed;
         if (missing > 0) {
-            process.stdout.write(`\n${missing} control${missing === 1 ? '' : 's'} missing.`);
-            process.stdout.write(` Run '${colors.cyan}hackmyagent harden-soul${colors.reset}' to remediate.\n`);
+            const recoverable = Math.min(100 - result.score, 100);
+            process.stdout.write(`\n  Path forward: +${recoverable} recoverable by addressing ${missing} control${missing === 1 ? '' : 's'}`);
+            process.stdout.write(`\n  Run '${colors.cyan}${prefix} harden-soul${colors.reset}' to remediate.\n`);
         }
         else {
             process.stdout.write(`\n${colors.green}All ${result.totalControls} governance controls covered.${colors.reset}\n`);
@@ -3744,6 +3904,8 @@ program
 
 Runs scan-soul internally to identify missing controls, then generates
 template content for each missing domain. Existing content is preserved.
+Supports iterative hardening: if a domain heading exists but controls
+fail within it, appends targeted remediation for those controls.
 
 Modes:
   Default:    Append missing sections to SOUL.md (or create it)
@@ -3756,6 +3918,7 @@ Examples:
   $ hackmyagent harden-soul --json           Machine-readable output`)
     .argument('[directory]', 'Directory to harden (defaults to current directory)', '.')
     .option('--dry-run', 'Preview changes without modifying files')
+    .option('--profile <profile>', 'Override agent profile (conversational, code-assistant, tool-agent, autonomous, orchestrator, custom)')
     .option('--json', 'Output as JSON')
     .action(async (directory, options) => {
     try {
@@ -3764,8 +3927,9 @@ Examples:
             process.stderr.write(`Error: Directory '${targetDir}' does not exist.\n`);
             process.exit(1);
         }
+        const prefix = getCommandPrefix();
         const scanner = new index_1.SoulScanner();
-        const result = await scanner.hardenSoul(targetDir, { dryRun: options.dryRun });
+        const result = await scanner.hardenSoul(targetDir, { dryRun: options.dryRun, profile: options.profile });
         // JSON output
         if (options.json) {
             // Exclude full content from JSON to keep it concise
@@ -3776,13 +3940,13 @@ Examples:
                 dryRun: result.dryRun,
                 existedBefore: result.existedBefore,
             };
-            process.stdout.write(JSON.stringify(jsonResult, null, 2) + '\n');
+            writeJsonStdout(jsonResult);
             return;
         }
         // Text output
         if (result.sectionsAdded.length === 0) {
             process.stdout.write(`\n${colors.green}All governance domains already have sections in ${result.file}.${colors.reset}\n`);
-            process.stdout.write(`Run 'hackmyagent scan-soul --verbose' to see individual control coverage.\n\n`);
+            process.stdout.write(`Run '${prefix} scan-soul --verbose' to see individual control coverage.\n\n`);
             return;
         }
         if (result.dryRun) {
@@ -3817,7 +3981,7 @@ Examples:
                 process.stdout.write(`  ${colors.green}+${colors.reset} ${section}\n`);
             }
             process.stdout.write(`Controls covered: +${result.controlsAdded}\n\n`);
-            process.stdout.write(`Run '${colors.cyan}hackmyagent scan-soul${colors.reset}' to verify coverage.\n\n`);
+            process.stdout.write(`Run '${colors.cyan}${prefix} scan-soul${colors.reset}' to verify coverage.\n\n`);
         }
     }
     catch (error) {