hackmyagent 0.9.6 → 0.9.8

package/dist/hardening/scanner.js

@@ -203,6 +203,9 @@ const SEVERITY_WEIGHTS = {
 const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB max file size to prevent memory exhaustion
 const MAX_LINE_LENGTH = 10000; // 10KB max line length for regex safety
 class HardeningScanner {
+    constructor() {
+        this.cliName = 'hackmyagent';
+    }
     /**
      * Validate that a file path is within the target directory (no path traversal)
      */
@@ -212,7 +215,8 @@ class HardeningScanner {
         return normalizedFile.startsWith(normalizedDir + path.sep) || normalizedFile === normalizedDir;
     }
     async scan(options) {
-        const { targetDir, autoFix = false, dryRun = false, ignore = [] } = options;
+        const { targetDir, autoFix = false, dryRun = false, ignore = [], cliName = 'hackmyagent' } = options;
+        this.cliName = cliName;
         // Normalize ignore list to uppercase for case-insensitive matching
         const ignoredChecks = new Set(ignore.map((id) => id.toUpperCase()));
         // In dry-run mode, we detect what would be fixed but don't modify anything
@@ -663,7 +667,7 @@ class HardeningScanner {
                         line: firstLine,
                         fixable: true,
                         fixed: fileModified,
-                        fix: `Run \`hackmyagent secure --fix\` to replace the hardcoded credential with a \${ENV_VAR} reference, then store the actual value in your .env file`,
+                        fix: `Run \`${this.cliName} secure --fix\` to replace the hardcoded credential with a \${ENV_VAR} reference, then store the actual value in your .env file`,
                     });
                 }
             }
@@ -781,7 +785,7 @@ class HardeningScanner {
                     file: 'mcp.json',
                     fixable: true,
                     fixed: mcp001Fixed,
-                    fix: 'Run `hackmyagent secure --fix` to restrict filesystem access from / or ~ to project-relative paths (./data or ./)',
+                    fix: `Run \`${this.cliName} secure --fix\` to restrict filesystem access from / or ~ to project-relative paths (./data or ./)`,
                 });
             }
             if (hasUnrestrictedShell) {
@@ -900,7 +904,7 @@ dist/
                 file: '.gitignore',
                 fixable: true,
                 fixed: git001Fixed,
-                fix: 'Run `hackmyagent secure --fix` to create a .gitignore with security patterns (.env, secrets.json, *.pem, *.key) to prevent accidental commits',
+                fix: `Run \`${this.cliName} secure --fix\` to create a .gitignore with security patterns (.env, secrets.json, *.pem, *.key) to prevent accidental commits`,
             });
         }
         // GIT-002: Check for missing sensitive patterns in .gitignore
@@ -931,7 +935,7 @@ dist/
                 file: '.gitignore',
                 fixable: true,
                 fixed: git002Fixed,
-                fix: `Run \`hackmyagent secure --fix\` to add ${missingPatterns.join(', ')} to .gitignore so sensitive files won't be accidentally committed`,
+                fix: `Run \`${this.cliName} secure --fix\` to add ${missingPatterns.join(', ')} to .gitignore so sensitive files won't be accidentally committed`,
             });
         }
         // GIT-003: Check if .env exists but not in .gitignore
@@ -967,7 +971,7 @@ dist/
                 file: '.env',
                 fixable: true,
                 fixed: git003Fixed,
-                fix: 'Run `hackmyagent secure --fix` to add .env to .gitignore so your environment variables won\'t be accidentally committed',
+                fix: `Run \`${this.cliName} secure --fix\` to add .env to .gitignore so your environment variables won't be accidentally committed`,
             });
         }
         return findings;
@@ -1012,7 +1016,7 @@ dist/
                 file: 'mcp.json',
                 fixable: true,
                 fixed: net001Fixed,
-                fix: 'Run `hackmyagent secure --fix` to change 0.0.0.0 to 127.0.0.1 so the server only accepts local connections instead of being exposed to the network',
+                fix: `Run \`${this.cliName} secure --fix\` to change 0.0.0.0 to 127.0.0.1 so the server only accepts local connections instead of being exposed to the network`,
             });
         }
         // NET-002: Check for remote MCP servers without TLS
@@ -1105,7 +1109,7 @@ dist/
                 file: 'mcp.json',
                 fixable: true,
                 fixed: mcp003Fixed,
-                fix: 'Run `hackmyagent secure --fix` to replace hardcoded API keys with ${ENV_VAR} references, then store actual values in .env file',
+                fix: `Run \`${this.cliName} secure --fix\` to replace hardcoded API keys with \${ENV_VAR} references, then store actual values in .env file`,
             });
         }
         // MCP-004: Check for default credentials
@@ -4420,7 +4424,7 @@ dist/
                     fixable: true,
                     fixed: gateway001Fixed,
                     fixMessage: gateway001Fixed ? 'Changed gateway.host from 0.0.0.0 to 127.0.0.1' : undefined,
-                    fix: 'Run `hackmyagent secure-openclaw --fix` to bind gateway to 127.0.0.1 for local-only access',
+                    fix: `Run \`${this.cliName} secure-openclaw --fix\` to bind gateway to 127.0.0.1 for local-only access`,
                 });
             }
             // GATEWAY-002: Missing WebSocket Origin Validation (not auto-fixable - requires user to specify allowed origins)
@@ -4476,7 +4480,7 @@ dist/
                     fixable: true,
                     fixed: gateway003Fixed,
                     fixMessage: gateway003Fixed ? 'Replaced plaintext token with ${OPENCLAW_AUTH_TOKEN} env var reference. Set OPENCLAW_AUTH_TOKEN in your environment.' : undefined,
-                    fix: 'Run `hackmyagent secure-openclaw --fix` to replace plaintext token with ${OPENCLAW_AUTH_TOKEN} env var reference',
+                    fix: `Run \`${this.cliName} secure-openclaw --fix\` to replace plaintext token with \${OPENCLAW_AUTH_TOKEN} env var reference`,
                 });
             }
             // GATEWAY-004: Approval Confirmations Disabled
@@ -4523,7 +4527,7 @@ dist/
                     fixable: true,
                     fixed: gateway004Fixed,
                     fixMessage: gateway004Fixed ? 'Enabled approval confirmations for command execution' : undefined,
-                    fix: 'Run `hackmyagent secure-openclaw --fix` to enable approval confirmations for safer command execution',
+                    fix: `Run \`${this.cliName} secure-openclaw --fix\` to enable approval confirmations for safer command execution`,
                 });
             }
             // GATEWAY-005: Sandbox Disabled
@@ -4552,7 +4556,7 @@ dist/
                     fixable: true,
                     fixed: gateway005Fixed,
                     fixMessage: gateway005Fixed ? 'Enabled sandbox mode for isolated code execution' : undefined,
-                    fix: 'Run `hackmyagent secure-openclaw --fix` to enable sandbox mode for safer code execution',
+                    fix: `Run \`${this.cliName} secure-openclaw --fix\` to enable sandbox mode for safer code execution`,
                 });
             }
             // GATEWAY-006: Container Escape Risk (not auto-fixable - requires manual review of mount points)