opena2a-cli 0.5.12 → 0.6.0

package/dist/report/review-html.js

@@ -4,7 +4,7 @@
  *
  * Generates a self-contained HTML file with:
  * - Dark theme (#0f172a bg, #1e293b cards, teal primary)
- * - 6-tab navigation (Overview, Credentials, Hygiene, Integrity, Shield, HMA)
+ * - 7-tab navigation (Overview, Credentials, Hygiene, Integrity, Shield, HMA, Shadow AI)
  * - Composite score gauge with recovery summary
  * - Phase status cards with timing
  * - Cross-tab navigation
@@ -29,24 +29,7 @@ function generateReviewHtml(report) {
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>OpenA2A Security Review - ${esc(report.projectName ?? 'Project')}</title>
 <style>
-:root {
-  --bg: #0f172a;
-  --card: #1e293b;
-  --card-border: #334155;
-  --primary: #06b6d4;
-  --text: #e2e8f0;
-  --muted: #94a3b8;
-  --dim: #64748b;
-  --critical: #ef4444;
-  --high: #f97316;
-  --medium: #eab308;
-  --low: #3b82f6;
-  --info: #6b7280;
-  --green: #22c55e;
-  --red: #ef4444;
-  --amber: #f59e0b;
-  --font: 'JetBrains Mono','Fira Code','SF Mono',Menlo,Consolas,monospace;
-}
+:root{--bg:#0f172a;--card:#1e293b;--card-border:#334155;--primary:#06b6d4;--text:#e2e8f0;--muted:#94a3b8;--dim:#64748b;--critical:#ef4444;--high:#f97316;--medium:#eab308;--low:#3b82f6;--info:#6b7280;--green:#22c55e;--red:#ef4444;--amber:#f59e0b;--font:'JetBrains Mono','Fira Code','SF Mono',Menlo,Consolas,monospace;}
 *{margin:0;padding:0;box-sizing:border-box;}
 body{background:var(--bg);color:var(--text);font-family:var(--font);font-size:14px;line-height:1.6;}
 .container{max-width:1200px;margin:0 auto;padding:16px 20px;}
@@ -57,8 +40,7 @@ body{background:var(--bg);color:var(--text);font-family:var(--font);font-size:14
 .nav-tab{background:none;border:none;color:var(--dim);font-family:var(--font);font-size:13px;padding:8px 14px;cursor:pointer;border-bottom:2px solid transparent;transition:all 0.15s;}
 .nav-tab:hover{color:var(--text);}
 .nav-tab.active{color:var(--primary);border-bottom-color:var(--primary);}
-.page{display:none;}
-.page.active{display:block;}
+.page{display:none;}.page.active{display:block;}
 .card{background:var(--card);border:1px solid var(--card-border);border-radius:6px;padding:16px;margin-bottom:12px;}
 .card-title{font-size:14px;font-weight:700;color:var(--text);margin-bottom:10px;}
 .stats-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(150px,1fr));gap:8px;margin-bottom:16px;}
@@ -72,7 +54,7 @@ body{background:var(--bg);color:var(--text);font-family:var(--font);font-size:14
 .score-banner-track{height:6px;background:rgba(255,255,255,0.06);border-radius:3px;overflow:hidden;}
 .score-banner-fill{height:100%;border-radius:3px;transition:width 0.3s;}
 .score-banner-label{font-size:12px;color:var(--dim);display:flex;justify-content:space-between;}
-.phase-grid{display:grid;grid-template-columns:repeat(5,1fr);gap:8px;margin-bottom:16px;}
+.phase-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(160px,1fr));gap:8px;margin-bottom:16px;}
 .phase-card{background:var(--card);border:1px solid var(--card-border);border-radius:6px;padding:12px 14px;}
 .phase-name{font-size:13px;font-weight:600;margin-bottom:4px;}
 .phase-detail{font-size:12px;color:var(--muted);}
@@ -148,7 +130,7 @@ body{background:var(--bg);color:var(--text);font-family:var(--font);font-size:14
   <div class="header">
     <div>
       <div class="header-title">OpenA2A Security Review</div>
-      <div class="header-subtitle">Security review of <strong style="color:var(--text)">${esc(report.projectName ?? report.directory)}</strong> -- composite score from 5 automated checks. Higher is better.</div>
+      <div class="header-subtitle">Security review of <strong style="color:var(--text)">${esc(report.projectName ?? report.directory)}</strong> -- composite score from 6 automated checks. Higher is better.</div>
     </div>
     <div class="header-meta">${esc(report.timestamp)}</div>
   </div>
@@ -159,6 +141,7 @@ body{background:var(--bg);color:var(--text);font-family:var(--font);font-size:14
     <button class="nav-tab" data-page="integrity">Integrity</button>
     <button class="nav-tab" data-page="shield">Shield</button>
     <button class="nav-tab" data-page="hma">HMA</button>
+    <button class="nav-tab" data-page="shadowai">Shadow AI</button>
   </nav>
   <div class="page active" id="page-overview"></div>
   <div class="page" id="page-credentials"></div>
@@ -166,427 +149,12 @@ body{background:var(--bg);color:var(--text);font-family:var(--font);font-size:14
   <div class="page" id="page-integrity"></div>
   <div class="page" id="page-shield"></div>
   <div class="page" id="page-hma"></div>
+  <div class="page" id="page-shadowai"></div>
   <div class="footer">Generated by <a href="https://opena2a.org" target="_blank" rel="noopener">OpenA2A</a> -- Open Agent-to-Agent Security Platform</div>
 </div>
-
 <script id="report-data" type="application/json">${jsonData}</script>
 <script>
-(function(){
-  var report = JSON.parse(document.getElementById('report-data').textContent);
-  var pagesRendered = {};
-
-  function esc(s){return s==null?'':String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;');}
-  function scoreColor(s){return s>=90?'var(--green)':s>=70?'var(--primary)':s>=50?'var(--medium)':'var(--red)';}
-
-  // Tab navigation
-  document.getElementById('main-nav').addEventListener('click',function(e){
-    var btn=e.target.closest('.nav-tab');if(!btn)return;
-    var pg=btn.getAttribute('data-page');
-    document.querySelectorAll('.nav-tab').forEach(function(t){t.classList.toggle('active',t===btn);});
-    document.querySelectorAll('.page').forEach(function(p){p.classList.toggle('active',p.id==='page-'+pg);});
-    renderPage(pg);
-  });
-
-  function renderPage(pg){
-    if(pagesRendered[pg])return;pagesRendered[pg]=true;
-    var el=document.getElementById('page-'+pg);
-    switch(pg){
-      case 'overview':el.innerHTML=renderOverview();break;
-      case 'credentials':el.innerHTML=renderCredentials();break;
-      case 'hygiene':el.innerHTML=renderHygiene();break;
-      case 'integrity':el.innerHTML=renderIntegrity();break;
-      case 'shield':el.innerHTML=renderShield();break;
-      case 'hma':el.innerHTML=renderHma();break;
-    }
-  }
-
-  // Copy command
-  window.copyCmd=function(btn){
-    var cmd=btn.getAttribute('data-cmd');
-    if(navigator.clipboard&&navigator.clipboard.writeText){
-      navigator.clipboard.writeText(cmd).then(function(){
-        btn.textContent='OK';btn.classList.add('copied');
-        setTimeout(function(){btn.textContent='Copy';btn.classList.remove('copied');},1500);
-      });
-    }else{
-      var ta=document.createElement('textarea');ta.value=cmd;ta.style.position='fixed';ta.style.left='-9999px';
-      document.body.appendChild(ta);ta.select();document.execCommand('copy');document.body.removeChild(ta);
-      btn.textContent='OK';btn.classList.add('copied');
-      setTimeout(function(){btn.textContent='Copy';btn.classList.remove('copied');},1500);
-    }
-  };
-
-  // Cross-tab navigation
-  window.goToTab=function(tab){
-    var btn=document.querySelector('.nav-tab[data-page="'+tab+'"]');
-    if(btn)btn.click();
-  };
-
-  // Gauge SVG
-  function gaugeCircle(score,label){
-    var sz=170,cx=sz/2,cy=sz/2,r=65,sw=10,circ=2*Math.PI*r;
-    var pct=Math.max(0,Math.min(100,score))/100,dash=pct*circ,gap=circ-dash;
-    var clr=score>=90?'#22c55e':score>=70?'#06b6d4':score>=50?'#eab308':'#ef4444';
-    var s='<svg width="'+sz+'" height="'+sz+'" viewBox="0 0 '+sz+' '+sz+'">';
-    s+='<circle cx="'+cx+'" cy="'+cy+'" r="'+r+'" fill="none" stroke="rgba(255,255,255,0.05)" stroke-width="'+sw+'"/>';
-    s+='<circle cx="'+cx+'" cy="'+cy+'" r="'+r+'" fill="none" stroke="'+clr+'" stroke-width="'+sw+'" stroke-dasharray="'+dash+' '+gap+'" stroke-dashoffset="'+(circ*0.25)+'" stroke-linecap="round" transform="rotate(-90 '+cx+' '+cy+')"/>';
-    s+='<text x="'+cx+'" y="'+(cy-6)+'" text-anchor="middle" dominant-baseline="middle" font-size="32" font-weight="700" fill="'+clr+'" font-family="var(--font)">'+score+'</text>';
-    s+='<text x="'+cx+'" y="'+(cy+20)+'" text-anchor="middle" dominant-baseline="middle" font-size="14" font-weight="600" fill="'+clr+'" font-family="var(--font)">'+esc(label||('out of 100'))+'</text>';
-    s+='</svg>';return s;
-  }
-
-  function cmdBlock(cmd){
-    return '<div class="cmd-block"><span class="cmd-text">'+esc(cmd)+'</span><button class="copy-btn" data-cmd="'+esc(cmd)+'" onclick="copyCmd(this)">Copy</button></div>';
-  }
-
-  function statCard(value,label,color){
-    return '<div class="stat-card"><div class="stat-value" style="color:'+color+'">'+esc(String(value))+'</div><div class="stat-label">'+esc(label)+'</div></div>';
-  }
-
-  function scoreBanner(score,recoverySummary){
-    var clr=scoreColor(score);
-    var h='<div class="score-banner">';
-    h+='<div class="score-banner-num" style="color:'+clr+'">'+score+'</div>';
-    h+='<div class="score-banner-bar">';
-    h+='<div class="score-banner-label"><span>Composite Score</span><span>'+score+'/100</span></div>';
-    h+='<div class="score-banner-track"><div class="score-banner-fill" style="width:'+score+'%;background:'+clr+'"></div></div>';
-    h+='</div>';
-    // Recovery-framed: show path forward instead of letter grade
-    if(recoverySummary && recoverySummary.totalRecoverable>0){
-      var recovBg=score>=70?'rgba(6,182,212,0.15)':score>=50?'rgba(234,179,8,0.15)':'rgba(239,68,68,0.15)';
-      h+='<div class="score-banner-grade" style="color:'+clr+';background:'+recovBg+'">+'+recoverySummary.totalRecoverable+' recoverable</div>';
-    }
-    h+='</div>';
-    return h;
-  }
-
-  var phaseDescriptions={
-    'Project Scan':'Checks .gitignore, lock files, security config, and dependency advisories',
-    'Credentials':'Scans source files for hardcoded API keys, tokens, and secrets',
-    'Config Integrity':'Verifies cryptographic signatures on monitored config files',
-    'Shield Analysis':'Analyzes 7 days of security events, policy violations, and ARP detections',
-    'HMA Scan':'Runs HackMyAgent security checks against your AI agent endpoints'
-  };
-  function phaseCard(phase){
-    var statusCls='status-'+phase.status;
-    var time=phase.status==='skip'?'--':(phase.durationMs/1000).toFixed(1)+'s';
-    var desc=phaseDescriptions[phase.name]||'';
-    return '<div class="phase-card"><div style="display:flex;justify-content:space-between;align-items:center"><div class="phase-name">'+esc(phase.name)+'</div><span class="status-badge '+statusCls+'">'+esc(phase.status)+'</span></div><div class="phase-detail">'+esc(phase.detail)+'</div>'+(desc?'<div class="phase-desc">'+esc(desc)+'</div>':'')+'<div class="phase-time">'+esc(time)+'</div></div>';
-  }
-
-  // ======================== OVERVIEW ========================
-  function renderOverview(){
-    var h='';
-    // Score banner
-    var sevCounts={critical:0,high:0,medium:0,low:0};
-    var findings=report.findings||[];
-    for(var i=0;i<findings.length;i++){var s=findings[i].severity;if(s in sevCounts)sevCounts[s]++;}
-    h+=scoreBanner(report.compositeScore,report.recoverySummary);
-    h+='<div class="stats-grid">';
-    h+=statCard(findings.length,'Findings',findings.length>0?'var(--amber)':'var(--green)');
-    h+=statCard(sevCounts.critical,'Critical',sevCounts.critical>0?'var(--critical)':'var(--text)');
-    h+=statCard(sevCounts.high,'High',sevCounts.high>0?'var(--high)':'var(--text)');
-    h+=statCard(sevCounts.medium,'Medium',sevCounts.medium>0?'var(--medium)':'var(--text)');
-    h+='</div>';
-
-    // Phase cards (full width, 5 columns)
-    h+='<h2 class="section-title">Phase Results</h2><div class="phase-grid">';
-    var phases=report.phases||[];
-    for(var i=0;i<phases.length;i++) h+=phaseCard(phases[i]);
-    h+='</div>';
-
-    // Score breakdown -- show actual score, weight, weighted contribution per dimension
-    var dims=[
-      {name:'Hygiene',weight:35,score:report.initData.trustScore,tab:'hygiene'},
-      {name:'Shield',weight:25,score:report.shieldData.postureScore,tab:'shield'},
-      {name:'Credentials',weight:22,score:phases.length>1?phases[1].score:0,tab:'credentials'},
-      {name:'Integrity',weight:18,score:phases.length>2?phases[2].score:0,tab:'integrity'}
-    ];
-    h+='<div class="score-explainer">';
-    h+='<div style="font-size:12px;color:var(--dim);text-transform:uppercase;letter-spacing:0.5px;margin-bottom:12px">Score Breakdown</div>';
-    h+='<div style="display:flex;flex-direction:column;gap:10px">';
-    for(var i=0;i<dims.length;i++){
-      var d=dims[i];
-      var weighted=Math.round(d.score*d.weight/100);
-      var clr=scoreColor(d.score);
-      h+='<div style="display:grid;grid-template-columns:100px 1fr 60px 50px;align-items:center;gap:10px;cursor:pointer" onclick="goToTab(&quot;'+d.tab+'&quot;)">';
-      h+='<div style="display:flex;align-items:baseline;gap:6px"><span style="font-size:13px;color:var(--muted)">'+esc(d.name)+'</span></div>';
-      h+='<div style="position:relative;height:8px;background:rgba(255,255,255,0.06);border-radius:4px;overflow:hidden"><div style="position:absolute;left:0;top:0;height:100%;width:'+d.score+'%;background:'+clr+';border-radius:4px;transition:width 0.3s"></div></div>';
-      h+='<div style="text-align:right;font-size:14px;font-weight:700;color:'+clr+'">'+d.score+'<span style="font-size:11px;color:var(--dim);font-weight:400">/100</span></div>';
-      h+='<div style="text-align:right;font-size:11px;color:var(--dim)">x '+d.weight+'%</div>';
-      h+='</div>';
-    }
-    h+='</div>';
-    h+='<div style="display:flex;justify-content:space-between;align-items:center;border-top:1px solid rgba(51,65,85,0.4);margin-top:12px;padding-top:8px">';
-    h+='<div style="display:flex;gap:12px;font-size:12px;color:var(--dim)">';
-    h+='<span><strong style="color:var(--green)">A</strong> 90+</span>';
-    h+='<span><strong style="color:var(--primary)">B</strong> 80+</span>';
-    h+='<span><strong style="color:var(--medium)">C</strong> 70+</span>';
-    h+='<span><strong style="color:var(--high)">D</strong> 60+</span>';
-    h+='<span><strong style="color:var(--red)">F</strong> &lt;60</span>';
-    h+='</div>';
-    h+='<div style="font-size:12px;color:var(--dim)">Click a row to view details</div>';
-    h+='</div>';
-    h+='</div>';
-
-    // Action items
-    var actions=report.actionItems||[];
-    var actionImpact={
-      'critical':'Immediate risk of credential compromise or data breach',
-      'high':'Significant security gap that attackers can exploit',
-      'medium':'Moderate risk that weakens your security posture',
-      'low':'Minor improvement to harden your defenses',
-      'info':'Recommended best practice'
-    };
-    if(actions.length>0){
-      h+='<h2 class="section-title">Action Items</h2><div class="card">';
-      for(var i=0;i<actions.length;i++){
-        var a=actions[i];
-        var impact=actionImpact[a.severity]||'';
-        h+='<div class="action-item"><div class="action-priority">#'+a.priority+'</div><div class="action-content"><div class="action-desc"><span class="sev-badge sev-'+esc(a.severity)+'">'+esc(a.severity)+'</span> '+esc(a.description)+'</div>'+(impact?'<div class="check-desc">'+esc(impact)+'</div>':'')+cmdBlock(a.command)+'<span class="action-link" onclick="goToTab(&quot;'+esc(a.tab)+'&quot;)">View details</span></div></div>';
-      }
-      h+='</div>';
-    }
-
-    // Top findings
-    if(findings.length>0){
-      h+='<h2 class="section-title">Findings</h2><div class="card"><table class="data-table"><thead><tr><th>ID</th><th>Title</th><th>Severity</th><th>Source</th><th>Detail</th></tr></thead><tbody>';
-      var top=findings.slice(0,10);
-      for(var i=0;i<top.length;i++){var f=top[i];
-        h+='<tr><td>'+esc(f.id)+'</td><td>'+esc(f.title)+'</td><td><span class="sev-badge sev-'+esc(f.severity)+'">'+esc(f.severity)+'</span></td><td>'+esc(f.source)+'</td><td style="font-size:11px;color:var(--muted)">'+esc(f.detail)+'</td></tr>';
-      }
-      h+='</tbody></table></div>';
-    }
-    return h;
-  }
-
-  // ======================== CREDENTIALS ========================
-  function renderCredentials(){
-    var data=report.credentialData;
-    if(!data||data.totalFindings===0){
-      return '<div class="card"><div class="empty-state">No hardcoded credentials found. Your project is clean.</div></div>';
-    }
-    var h='<div class="section-intro">Hardcoded credentials in source code are the #1 cause of security breaches in AI projects. Keys pushed to git are scraped by bots within minutes. Each finding below is a credential that should be moved to environment variables.</div>';
-    h+='<div class="stats-grid">';
-    h+=statCard(data.totalFindings,'Total Findings',data.totalFindings>0?'var(--red)':'var(--green)');
-    h+=statCard(data.bySeverity.critical||0,'Critical',(data.bySeverity.critical||0)>0?'var(--critical)':'var(--text)');
-    h+=statCard(data.bySeverity.high||0,'High',(data.bySeverity.high||0)>0?'var(--high)':'var(--text)');
-    h+=statCard(data.bySeverity.medium||0,'Medium',(data.bySeverity.medium||0)>0?'var(--medium)':'var(--text)');
-    h+='</div>';
-
-    h+='<h2 class="section-title">Credential Findings</h2>';
-    var matches=data.matches||[];
-    for(var i=0;i<matches.length;i++){
-      var m=matches[i];
-      h+='<div class="cred-card">';
-      h+='<div class="cred-card-header"><span class="sev-badge sev-'+esc(m.severity)+'">'+esc(m.severity)+'</span><span class="cred-card-title">'+esc(m.title)+'</span><span style="color:var(--dim);font-size:12px">'+esc(m.findingId)+'</span></div>';
-      h+='<div class="cred-card-meta">';
-      h+='<div><div class="cred-card-meta-label">File</div><div class="cred-card-meta-value">'+esc(m.filePath)+':'+m.line+'</div></div>';
-      h+='<div><div class="cred-card-meta-label">Migrate to</div><div class="cred-card-meta-value env">'+esc(m.envVar)+'</div></div>';
-      h+='</div>';
-      if(m.explanation||m.businessImpact){
-        h+='<div class="cred-card-detail">';
-        if(m.explanation){h+='<div class="cred-card-detail-label">Why this matters</div><div class="cred-card-detail-text">'+esc(m.explanation)+'</div>';}
-        if(m.businessImpact){h+='<div class="cred-card-detail-label">Business impact</div><div class="cred-card-detail-text">'+esc(m.businessImpact)+'</div>';}
-        h+='</div>';
-      }
-      h+='</div>';
-    }
-
-    // Drift
-    if(data.driftFindings&&data.driftFindings.length>0){
-      h+='<h2 class="section-title">Scope Drift</h2>';
-      h+='<div class="card"><p style="color:var(--muted);font-size:12px;margin-bottom:8px;line-height:1.5">Scope drift occurs when a key provisioned for one service (e.g., Google Maps) silently grants access to AI services (e.g., Gemini). The key\\\'s permissions are wider than intended, expanding your attack surface without any code change.</p>';
-      h+='<table class="data-table"><thead><tr><th>ID</th><th>File</th><th>Line</th></tr></thead><tbody>';
-      for(var i=0;i<data.driftFindings.length;i++){
-        var d=data.driftFindings[i];
-        h+='<tr><td>'+esc(d.findingId)+'</td><td style="font-size:11px;color:var(--muted)">'+esc(d.filePath)+'</td><td>'+d.line+'</td></tr>';
-      }
-      h+='</tbody></table></div>';
-    }
-
-    h+='<h2 class="section-title">Remediation</h2>';
-    h+='<div class="card">'+cmdBlock('opena2a protect')+'<p style="color:var(--muted);font-size:12px;margin-top:8px">Migrate hardcoded credentials to environment variables or encrypted vault.</p></div>';
-    return h;
-  }
-
-  // ======================== HYGIENE ========================
-  var hygieneDescriptions={
-    'Credential scan':'Detects API keys and secrets hardcoded in source files',
-    'credentials':'Detects API keys and secrets hardcoded in source files',
-    '.gitignore':'Prevents sensitive files from being committed to version control',
-    'gitignore':'Prevents sensitive files from being committed to version control',
-    '.env protection':'Ensures .env files (which store secrets) are excluded from git',
-    'env protection':'Ensures .env files (which store secrets) are excluded from git',
-    'Lock file':'Pins exact dependency versions to prevent supply chain attacks',
-    'lock file':'Pins exact dependency versions to prevent supply chain attacks',
-    'Security config':'OpenA2A configuration enables automated security monitoring',
-    'security config':'OpenA2A configuration enables automated security monitoring'
-  };
-  function findHygieneDesc(label){
-    if(!label)return '';
-    var lc=label.toLowerCase();
-    for(var key in hygieneDescriptions){if(lc.indexOf(key.toLowerCase())>=0)return hygieneDescriptions[key];}
-    return '';
-  }
-  function renderHygiene(){
-    var init=report.initData;
-    var h='<div class="section-intro">Project hygiene measures foundational security practices. These checks do not require any OpenA2A tools -- they are standard development practices that prevent accidental exposure.</div>';
-    h+='<div class="stats-grid">';
-    h+=statCard(init.trustScore+'/100','Trust Score',scoreColor(init.trustScore));
-    h+=statCard(init.postureScore+'/100','Posture Score',scoreColor(init.postureScore));
-    h+=statCard(init.riskLevel,'Risk Level',init.riskLevel==='SECURE'||init.riskLevel==='LOW'?'var(--green)':init.riskLevel==='MEDIUM'?'var(--medium)':'var(--red)');
-    h+='</div>';
-
-    h+='<div class="overview-top">';
-    h+='<div class="gauge-card">'+gaugeCircle(init.trustScore,'out of 100')+'</div>';
-    h+='<div>';
-    h+='<h2 class="section-title">Hygiene Checks</h2>';
-    h+='<div class="card">';
-    var checks=init.hygieneChecks||[];
-    for(var i=0;i<checks.length;i++){
-      var c=checks[i];
-      var statusClr=c.status==='pass'?'var(--green)':c.status==='fail'?'var(--red)':c.status==='warn'?'var(--medium)':'var(--dim)';
-      var desc=findHygieneDesc(c.label);
-      h+='<div class="hygiene-row"><div><span class="hygiene-label">'+esc(c.label)+'</span>'+(desc?'<div class="check-desc">'+esc(desc)+'</div>':'')+'</div><span style="color:'+statusClr+'">'+esc(c.detail)+'</span></div>';
-    }
-    h+='</div>';
-    h+='</div></div>';
-
-    h+='<div class="score-explainer">';
-    h+='<div style="font-size:12px;color:var(--dim);text-transform:uppercase;letter-spacing:0.5px;margin-bottom:8px">Trust Score Formula</div>';
-    h+='<div style="display:grid;grid-template-columns:1fr 1fr;gap:4px 16px;font-size:12px">';
-    h+='<div style="color:var(--muted)">Start</div><div style="color:var(--text);font-weight:600">100</div>';
-    h+='<div style="color:var(--muted)">Missing .gitignore</div><div style="color:var(--red)">-15</div>';
-    h+='<div style="color:var(--muted)">Unprotected .env</div><div style="color:var(--red)">-10</div>';
-    h+='<div style="color:var(--muted)">No lock file</div><div style="color:var(--amber)">-5</div>';
-    h+='<div style="color:var(--muted)">Security config</div><div style="color:var(--green)">+5 bonus</div>';
-    h+='</div>';
-    h+='</div>';
-
-    h+='<div class="stats-grid">';
-    h+=statCard(init.activeTools+'/'+init.totalTools,'Active Tools','var(--primary)');
-    h+=statCard(init.advisoryCount,'Advisories',init.advisoryCount>0?'var(--amber)':'var(--green)');
-    h+='</div>';
-
-    h+='<h2 class="section-title">Project Info</h2>';
-    h+='<div class="card">';
-    h+='<div class="hygiene-row"><span class="hygiene-label">Project</span><span>'+esc(init.projectName||'unnamed')+'</span></div>';
-    h+='<div class="hygiene-row"><span class="hygiene-label">Type</span><span>'+esc(init.projectType)+'</span></div>';
-    h+='<div class="hygiene-row"><span class="hygiene-label">Version</span><span>'+esc(init.projectVersion||'--')+'</span></div>';
-    h+='</div>';
-    return h;
-  }
-
-  // ======================== INTEGRITY ========================
-  function renderIntegrity(){
-    var guard=report.guardData;
-    var h='<div class="section-intro">ConfigGuard signs your configuration files with SHA-256 hashes. If anyone (or any agent) modifies a signed file, the tampering is immediately detectable. This is your first line of defense against configuration drift.</div>';
-    var statusClr=guard.signatureStatus==='valid'?'var(--green)':guard.signatureStatus==='tampered'?'var(--red)':'var(--dim)';
-    var statusLabel=guard.signatureStatus==='valid'?'Active':guard.signatureStatus==='tampered'?'Tampered':'Unsigned';
-
-    h+='<div class="stats-grid">';
-    h+=statCard(statusLabel,'Signature Status',statusClr);
-    h+=statCard(guard.filesMonitored,'Files Monitored','var(--primary)');
-    h+=statCard(guard.tamperedFiles?guard.tamperedFiles.length:0,'Tampered',(guard.tamperedFiles&&guard.tamperedFiles.length>0)?'var(--red)':'var(--green)');
-    h+='</div>';
-
-    if(guard.signatureStatus==='unsigned'){
-      h+='<div class="cta-card"><div class="cta-title">ConfigGuard Not Active</div><div class="cta-desc">Sign your config files to detect unauthorized modifications.</div>'+cmdBlock('opena2a guard sign')+'</div>';
-    }else if(guard.signatureStatus==='tampered'){
-      h+='<h2 class="section-title">Tampered Files</h2>';
-      h+='<div class="card"><table class="data-table"><thead><tr><th>File</th><th>Status</th></tr></thead><tbody>';
-      for(var i=0;i<guard.tamperedFiles.length;i++){
-        h+='<tr><td>'+esc(guard.tamperedFiles[i])+'</td><td><span class="sev-badge sev-critical">tampered</span></td></tr>';
-      }
-      h+='</tbody></table></div>';
-      h+='<h2 class="section-title">Remediation</h2>';
-      h+='<div class="card">'+cmdBlock('opena2a guard diff')+'<p style="color:var(--muted);font-size:12px;margin:4px 0">Review changes, then resign:</p>'+cmdBlock('opena2a guard resign')+'</div>';
-    }else{
-      h+='<div class="card"><div class="empty-state">All '+guard.filesMonitored+' monitored files have valid signatures.</div></div>';
-    }
-    return h;
-  }
-
-  // ======================== SHIELD ========================
-  function renderShield(){
-    var shield=report.shieldData;
-    var h='<div class="section-intro">Shield is the unified security orchestration layer. It collects events from all OpenA2A tools (ARP, ConfigGuard, Secretless, HMA) into a tamper-evident log and classifies them into actionable findings.</div>';
-    h+='<div class="stats-grid">';
-    h+=statCard(shield.postureScore+'/100','Posture Score',scoreColor(shield.postureScore));
-    h+=statCard(shield.eventCount,'Events (7d)','var(--primary)');
-    h+=statCard(shield.classifiedFindings?shield.classifiedFindings.length:0,'Findings',shield.classifiedFindings&&shield.classifiedFindings.length>0?'var(--amber)':'var(--green)');
-    h+=statCard(shield.policyLoaded?'Loaded':'None','Policy',shield.policyLoaded?'var(--green)':'var(--dim)');
-    h+=statCard(shield.policyMode||'--','Mode','var(--muted)');
-    h+=statCard(shield.integrityStatus||'healthy','Integrity',shield.integrityStatus==='healthy'?'var(--green)':'var(--red)');
-    h+='</div>';
-
-    // Classified findings
-    var cf=shield.classifiedFindings||[];
-    if(cf.length>0){
-      h+='<h2 class="section-title">Classified Findings</h2>';
-      h+='<div class="card"><table class="data-table"><thead><tr><th>ID</th><th>Title</th><th>Severity</th><th>Count</th><th>Remediation</th></tr></thead><tbody>';
-      for(var i=0;i<cf.length;i++){
-        var f=cf[i];
-        var badges='';
-        if(f.finding.owaspAgentic)badges+='<span class="badge-owasp">'+esc(f.finding.owaspAgentic)+'</span>';
-        if(f.finding.mitreAtlas)badges+='<span class="badge-mitre">'+esc(f.finding.mitreAtlas)+'</span>';
-        h+='<tr><td>'+esc(f.finding.id)+'</td><td>'+esc(f.finding.title)+(badges?' '+badges:'')+'</td><td><span class="sev-badge sev-'+esc(f.finding.severity)+'">'+esc(f.finding.severity)+'</span></td><td>'+f.count+'</td><td>'+cmdBlock(f.finding.remediation)+'</td></tr>';
-        if(f.finding.description){
-          h+='<tr><td colspan="5" class="finding-desc">'+esc(f.finding.description)+'</td></tr>';
-        }
-      }
-      h+='</tbody></table></div>';
-    }
-
-    // ARP stats
-    var arp=shield.arpStats;
-    if(arp&&arp.totalEvents>0){
-      h+='<h2 class="section-title">Runtime Protection (ARP)</h2>';
-      h+='<div class="card"><div class="arp-grid">';
-      h+='<div class="arp-stat"><div class="arp-stat-value">'+arp.totalEvents+'</div><div class="arp-stat-label">Total Events</div></div>';
-      h+='<div class="arp-stat"><div class="arp-stat-value" style="color:var(--amber)">'+arp.anomalies+'</div><div class="arp-stat-label">Anomalies</div></div>';
-      h+='<div class="arp-stat"><div class="arp-stat-value" style="color:var(--red)">'+arp.violations+'</div><div class="arp-stat-label">Violations</div></div>';
-      h+='<div class="arp-stat"><div class="arp-stat-value">'+arp.processEvents+'</div><div class="arp-stat-label">Process</div></div>';
-      h+='<div class="arp-stat"><div class="arp-stat-value">'+arp.networkEvents+'</div><div class="arp-stat-label">Network</div></div>';
-      h+='<div class="arp-stat"><div class="arp-stat-value">'+arp.enforcements+'</div><div class="arp-stat-label">Enforcements</div></div>';
-      h+='</div></div>';
-    }else{
-      h+='<h2 class="section-title">Runtime Protection (ARP)</h2>';
-      h+='<div class="section-intro">ARP (Agent Runtime Protection) monitors process spawns, network connections, and file access in real time. It detects anomalous agent behavior before damage occurs.</div>';
-      h+='<div class="card"><div class="empty-state">No ARP events in the last 7 days. Start runtime monitoring:</div>'+cmdBlock('opena2a runtime start')+'</div>';
-    }
-
-    if(!shield.policyLoaded){
-      h+='<h2 class="section-title">Policy</h2>';
-      h+='<div class="cta-card"><div class="cta-title">No Security Policy</div><div class="cta-desc">Initialize Shield to enable adaptive security policy.</div>'+cmdBlock('opena2a shield init')+'</div>';
-    }
-    return h;
-  }
-
-  // ======================== HMA ========================
-  function renderHma(){
-    var hma=report.hmaData;
-    if(!hma||!hma.available){
-      var h='<div class="section-intro">HackMyAgent runs 147 security checks against AI agent endpoints, testing for prompt injection, tool misuse, excessive agency, and OWASP Top 10 for LLM vulnerabilities.</div>';
-      h+='<div class="cta-card"><div class="cta-title">HackMyAgent Not Installed</div>';
-      h+='<div class="cta-desc">Install HMA to run comprehensive security scans against your AI agent.</div>';
-      h+=cmdBlock('npm install -g hackmyagent');
-      h+='<p style="color:var(--muted);font-size:13px;margin-top:12px;text-align:center">Then re-run: <code style="color:var(--primary)">opena2a review</code></p>';
-      h+='</div>';
-      return h;
-    }
-    var h='<div class="stats-grid">';
-    h+=statCard(hma.score+'/100','HMA Score',scoreColor(hma.score));
-    h+=statCard('Available','Status','var(--green)');
-    h+='</div>';
-    h+='<div class="card"><div class="empty-state">HMA is available. Run a full scan for detailed results:</div>'+cmdBlock('opena2a scan --deep')+'</div>';
-    return h;
-  }
-
-  // Initial render
-  renderPage('overview');
-})();
+(function(){var report=JSON.parse(document.getElementById('report-data').textContent);var pagesRendered={};function esc(s){return s==null?'':String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;');}function scoreColor(s){return s>=90?'var(--green)':s>=70?'var(--primary)':s>=50?'var(--medium)':'var(--red)';}document.getElementById('main-nav').addEventListener('click',function(e){var btn=e.target.closest('.nav-tab');if(!btn)return;var pg=btn.getAttribute('data-page');document.querySelectorAll('.nav-tab').forEach(function(t){t.classList.toggle('active',t===btn);});document.querySelectorAll('.page').forEach(function(p){p.classList.toggle('active',p.id==='page-'+pg);});renderPage(pg);});function renderPage(pg){if(pagesRendered[pg])return;pagesRendered[pg]=true;var el=document.getElementById('page-'+pg);switch(pg){case 'overview':el.innerHTML=renderOverview();break;case 'credentials':el.innerHTML=renderCredentials();break;case 'hygiene':el.innerHTML=renderHygiene();break;case 'integrity':el.innerHTML=renderIntegrity();break;case 'shield':el.innerHTML=renderShield();break;case 'hma':el.innerHTML=renderHma();break;case 'shadowai':el.innerHTML=renderShadowAi();break;}}window.copyCmd=function(btn){var cmd=btn.getAttribute('data-cmd');if(navigator.clipboard&&navigator.clipboard.writeText){navigator.clipboard.writeText(cmd).then(function(){btn.textContent='OK';btn.classList.add('copied');setTimeout(function(){btn.textContent='Copy';btn.classList.remove('copied');},1500);});}else{var ta=document.createElement('textarea');ta.value=cmd;ta.style.position='fixed';ta.style.left='-9999px';document.body.appendChild(ta);ta.select();document.execCommand('copy');document.body.removeChild(ta);btn.textContent='OK';btn.classList.add('copied');setTimeout(function(){btn.textContent='Copy';btn.classList.remove('copied');},1500);}};window.goToTab=function(tab){var btn=document.querySelector('.nav-tab[data-page="'+tab+'"]');if(btn)btn.click();};function gaugeCircle(score,label){var sz=170,cx=sz/2,cy=sz/2,r=65,sw=10,circ=2*Math.PI*r;var pct=Math.max(0,Math.min(100,score))/100,dash=pct*circ,gap=circ-dash;var clr=score>=90?'#22c55e':score>=70?'#06b6d4':score>=50?'#eab308':'#ef4444';var s='<svg width="'+sz+'" height="'+sz+'" viewBox="0 0 '+sz+' '+sz+'">';s+='<circle cx="'+cx+'" cy="'+cy+'" r="'+r+'" fill="none" stroke="rgba(255,255,255,0.05)" stroke-width="'+sw+'"/>';s+='<circle cx="'+cx+'" cy="'+cy+'" r="'+r+'" fill="none" stroke="'+clr+'" stroke-width="'+sw+'" stroke-dasharray="'+dash+' '+gap+'" stroke-dashoffset="'+(circ*0.25)+'" stroke-linecap="round" transform="rotate(-90 '+cx+' '+cy+')"/>';s+='<text x="'+cx+'" y="'+(cy-6)+'" text-anchor="middle" dominant-baseline="middle" font-size="32" font-weight="700" fill="'+clr+'" font-family="var(--font)">'+score+'</text>';s+='<text x="'+cx+'" y="'+(cy+20)+'" text-anchor="middle" dominant-baseline="middle" font-size="14" font-weight="600" fill="'+clr+'" font-family="var(--font)">'+esc(label||('out of 100'))+'</text>';s+='</svg>';return s;}function cmdBlock(cmd){return '<div class="cmd-block"><span class="cmd-text">'+esc(cmd)+'</span><button class="copy-btn" data-cmd="'+esc(cmd)+'" onclick="copyCmd(this)">Copy</button></div>';}function statCard(value,label,color){return '<div class="stat-card"><div class="stat-value" style="color:'+color+'">'+esc(String(value))+'</div><div class="stat-label">'+esc(label)+'</div></div>';}function scoreBanner(score,recoverySummary){var clr=scoreColor(score);var h='<div class="score-banner"><div class="score-banner-num" style="color:'+clr+'">'+score+'</div><div class="score-banner-bar"><div class="score-banner-label"><span>Composite Score</span><span>'+score+'/100</span></div><div class="score-banner-track"><div class="score-banner-fill" style="width:'+score+'%;background:'+clr+'"></div></div></div>';if(recoverySummary&&recoverySummary.totalRecoverable>0){var recovBg=score>=70?'rgba(6,182,212,0.15)':score>=50?'rgba(234,179,8,0.15)':'rgba(239,68,68,0.15)';h+='<div class="score-banner-grade" style="color:'+clr+';background:'+recovBg+'">+'+recoverySummary.totalRecoverable+' recoverable</div>';}h+='</div>';return h;}function governanceBanner(score,recoverablePoints){var clr=scoreColor(score);var h='<div class="score-banner"><div class="score-banner-num" style="color:'+clr+'">'+score+'</div><div class="score-banner-bar"><div class="score-banner-label"><span>Governance Score</span><span>'+score+'/100</span></div><div class="score-banner-track"><div class="score-banner-fill" style="width:'+score+'%;background:'+clr+'"></div></div></div>';if(recoverablePoints>0){var projected=Math.min(100,score+recoverablePoints);var recovBg=score>=70?'rgba(6,182,212,0.15)':score>=50?'rgba(234,179,8,0.15)':'rgba(239,68,68,0.15)';h+='<div class="score-banner-grade" style="color:'+clr+';background:'+recovBg+'">path to '+projected+'</div>';}h+='</div>';return h;}var phaseDescriptions={'Project Scan':'Checks .gitignore, lock files, security config, and dependency advisories','Credentials':'Scans source files for hardcoded API keys, tokens, and secrets','Config Integrity':'Verifies cryptographic signatures on monitored config files','Shield Analysis':'Analyzes 7 days of security events, policy violations, and ARP detections','HMA Scan':'Runs HackMyAgent security checks against your AI agent endpoints','Shadow AI':'Detects AI agents, MCP servers, and AI configs; checks governance posture'};function phaseCard(phase){var statusCls='status-'+phase.status;var time=phase.status==='skip'?'--':(phase.durationMs/1000).toFixed(1)+'s';var desc=phaseDescriptions[phase.name]||'';return '<div class="phase-card"><div style="display:flex;justify-content:space-between;align-items:center"><div class="phase-name">'+esc(phase.name)+'</div><span class="status-badge '+statusCls+'">'+esc(phase.status)+'</span></div><div class="phase-detail">'+esc(phase.detail)+'</div>'+(desc?'<div class="phase-desc">'+esc(desc)+'</div>':'')+'<div class="phase-time">'+esc(time)+'</div></div>';}function renderOverview(){var h='';var sevCounts={critical:0,high:0,medium:0,low:0};var findings=report.findings||[];for(var i=0;i<findings.length;i++){var s=findings[i].severity;if(s in sevCounts)sevCounts[s]++;}h+=scoreBanner(report.compositeScore,report.recoverySummary);h+='<div class="stats-grid">';h+=statCard(findings.length,'Findings',findings.length>0?'var(--amber)':'var(--green)');h+=statCard(sevCounts.critical,'Critical',sevCounts.critical>0?'var(--critical)':'var(--text)');h+=statCard(sevCounts.high,'High',sevCounts.high>0?'var(--high)':'var(--text)');h+=statCard(sevCounts.medium,'Medium',sevCounts.medium>0?'var(--medium)':'var(--text)');h+='</div>';h+='<h2 class="section-title">Phase Results</h2><div class="phase-grid">';var phases=report.phases||[];for(var i=0;i<phases.length;i++)h+=phaseCard(phases[i]);h+='</div>';var detectScore=report.detectData?report.detectData.governanceScore:100;var dims=[{name:'Hygiene',weight:30,score:report.initData.trustScore,tab:'hygiene'},{name:'Shield',weight:20,score:report.shieldData.postureScore,tab:'shield'},{name:'Credentials',weight:20,score:phases.length>1?phases[1].score:0,tab:'credentials'},{name:'Integrity',weight:15,score:phases.length>2?phases[2].score:0,tab:'integrity'},{name:'Shadow AI',weight:15,score:detectScore,tab:'shadowai'}];h+='<div class="score-explainer"><div style="font-size:12px;color:var(--dim);text-transform:uppercase;letter-spacing:0.5px;margin-bottom:12px">Score Breakdown</div><div style="display:flex;flex-direction:column;gap:10px">';for(var i=0;i<dims.length;i++){var d=dims[i];var clr=scoreColor(d.score);h+='<div style="display:grid;grid-template-columns:100px 1fr 60px 50px;align-items:center;gap:10px;cursor:pointer" onclick="goToTab(&quot;'+d.tab+'&quot;)"><div style="display:flex;align-items:baseline;gap:6px"><span style="font-size:13px;color:var(--muted)">'+esc(d.name)+'</span></div><div style="position:relative;height:8px;background:rgba(255,255,255,0.06);border-radius:4px;overflow:hidden"><div style="position:absolute;left:0;top:0;height:100%;width:'+d.score+'%;background:'+clr+';border-radius:4px;transition:width 0.3s"></div></div><div style="text-align:right;font-size:14px;font-weight:700;color:'+clr+'">'+d.score+'<span style="font-size:11px;color:var(--dim);font-weight:400">/100</span></div><div style="text-align:right;font-size:11px;color:var(--dim)">x '+d.weight+'%</div></div>';}h+='</div><div style="display:flex;justify-content:space-between;align-items:center;border-top:1px solid rgba(51,65,85,0.4);margin-top:12px;padding-top:8px"><div style="display:flex;gap:12px;font-size:12px;color:var(--dim)"><span><strong style="color:var(--green)">A</strong> 90+</span><span><strong style="color:var(--primary)">B</strong> 80+</span><span><strong style="color:var(--medium)">C</strong> 70+</span><span><strong style="color:var(--high)">D</strong> 60+</span><span><strong style="color:var(--red)">F</strong> &lt;60</span></div><div style="font-size:12px;color:var(--dim)">Click a row to view details</div></div></div>';var actions=report.actionItems||[];var actionImpact={'critical':'Immediate risk of credential compromise or data breach','high':'Significant security gap that attackers can exploit','medium':'Moderate risk that weakens your security posture','low':'Minor improvement to harden your defenses','info':'Recommended best practice'};if(actions.length>0){h+='<h2 class="section-title">Action Items</h2><div class="card">';for(var i=0;i<actions.length;i++){var a=actions[i];var impact=actionImpact[a.severity]||'';h+='<div class="action-item"><div class="action-priority">#'+a.priority+'</div><div class="action-content"><div class="action-desc"><span class="sev-badge sev-'+esc(a.severity)+'">'+esc(a.severity)+'</span> '+esc(a.description)+'</div>'+(impact?'<div class="check-desc">'+esc(impact)+'</div>':'')+cmdBlock(a.command)+'<span class="action-link" onclick="goToTab(&quot;'+esc(a.tab)+'&quot;)">View details</span></div></div>';}h+='</div>';}if(findings.length>0){h+='<h2 class="section-title">Findings</h2><div class="card"><table class="data-table"><thead><tr><th>ID</th><th>Title</th><th>Severity</th><th>Source</th><th>Detail</th></tr></thead><tbody>';var top=findings.slice(0,10);for(var i=0;i<top.length;i++){var f=top[i];h+='<tr><td>'+esc(f.id)+'</td><td>'+esc(f.title)+'</td><td><span class="sev-badge sev-'+esc(f.severity)+'">'+esc(f.severity)+'</span></td><td>'+esc(f.source)+'</td><td style="font-size:11px;color:var(--muted)">'+esc(f.detail)+'</td></tr>';}h+='</tbody></table></div>';}return h;}function renderCredentials(){var data=report.credentialData;if(!data||data.totalFindings===0)return '<div class="card"><div class="empty-state">No hardcoded credentials found. Your project is clean.</div></div>';var h='<div class="section-intro">Hardcoded credentials in source code are the #1 cause of security breaches in AI projects. Keys pushed to git are scraped by bots within minutes. Each finding below is a credential that should be moved to environment variables.</div>';h+='<div class="stats-grid">';h+=statCard(data.totalFindings,'Total Findings',data.totalFindings>0?'var(--red)':'var(--green)');h+=statCard(data.bySeverity.critical||0,'Critical',(data.bySeverity.critical||0)>0?'var(--critical)':'var(--text)');h+=statCard(data.bySeverity.high||0,'High',(data.bySeverity.high||0)>0?'var(--high)':'var(--text)');h+=statCard(data.bySeverity.medium||0,'Medium',(data.bySeverity.medium||0)>0?'var(--medium)':'var(--text)');h+='</div>';h+='<h2 class="section-title">Credential Findings</h2>';var matches=data.matches||[];for(var i=0;i<matches.length;i++){var m=matches[i];h+='<div class="cred-card"><div class="cred-card-header"><span class="sev-badge sev-'+esc(m.severity)+'">'+esc(m.severity)+'</span><span class="cred-card-title">'+esc(m.title)+'</span><span style="color:var(--dim);font-size:12px">'+esc(m.findingId)+'</span></div><div class="cred-card-meta"><div><div class="cred-card-meta-label">File</div><div class="cred-card-meta-value">'+esc(m.filePath)+':'+m.line+'</div></div><div><div class="cred-card-meta-label">Migrate to</div><div class="cred-card-meta-value env">'+esc(m.envVar)+'</div></div></div>';if(m.explanation||m.businessImpact){h+='<div class="cred-card-detail">';if(m.explanation)h+='<div class="cred-card-detail-label">Why this matters</div><div class="cred-card-detail-text">'+esc(m.explanation)+'</div>';if(m.businessImpact)h+='<div class="cred-card-detail-label">Business impact</div><div class="cred-card-detail-text">'+esc(m.businessImpact)+'</div>';h+='</div>';}h+='</div>';}if(data.driftFindings&&data.driftFindings.length>0){h+='<h2 class="section-title">Scope Drift</h2><div class="card"><p style="color:var(--muted);font-size:12px;margin-bottom:8px;line-height:1.5">Scope drift occurs when a key provisioned for one service silently grants access to AI services. The key\\\'s permissions are wider than intended.</p><table class="data-table"><thead><tr><th>ID</th><th>File</th><th>Line</th></tr></thead><tbody>';for(var i=0;i<data.driftFindings.length;i++){var d=data.driftFindings[i];h+='<tr><td>'+esc(d.findingId)+'</td><td style="font-size:11px;color:var(--muted)">'+esc(d.filePath)+'</td><td>'+d.line+'</td></tr>';}h+='</tbody></table></div>';}h+='<h2 class="section-title">Remediation</h2><div class="card">'+cmdBlock('opena2a protect')+'<p style="color:var(--muted);font-size:12px;margin-top:8px">Migrate hardcoded credentials to environment variables or encrypted vault.</p></div>';return h;}var hygieneDescriptions={'Credential scan':'Detects API keys and secrets hardcoded in source files','.gitignore':'Prevents sensitive files from being committed to version control','.env protection':'Ensures .env files (which store secrets) are excluded from git','Lock file':'Pins exact dependency versions to prevent supply chain attacks','Security config':'OpenA2A configuration enables automated security monitoring'};function findHygieneDesc(label){if(!label)return '';var lc=label.toLowerCase();for(var key in hygieneDescriptions){if(lc.indexOf(key.toLowerCase())>=0)return hygieneDescriptions[key];}return '';}function renderHygiene(){var init=report.initData;var h='<div class="section-intro">Project hygiene measures foundational security practices. These checks do not require any OpenA2A tools -- they are standard development practices that prevent accidental exposure.</div>';h+='<div class="stats-grid">';h+=statCard(init.trustScore+'/100','Trust Score',scoreColor(init.trustScore));h+=statCard(init.postureScore+'/100','Posture Score',scoreColor(init.postureScore));h+=statCard(init.riskLevel,'Risk Level',init.riskLevel==='SECURE'||init.riskLevel==='LOW'?'var(--green)':init.riskLevel==='MEDIUM'?'var(--medium)':'var(--red)');h+='</div>';h+='<div class="overview-top"><div class="gauge-card">'+gaugeCircle(init.trustScore,'out of 100')+'</div><div><h2 class="section-title">Hygiene Checks</h2><div class="card">';var checks=init.hygieneChecks||[];for(var i=0;i<checks.length;i++){var c=checks[i];var statusClr=c.status==='pass'?'var(--green)':c.status==='fail'?'var(--red)':c.status==='warn'?'var(--medium)':'var(--dim)';var desc=findHygieneDesc(c.label);h+='<div class="hygiene-row"><div><span class="hygiene-label">'+esc(c.label)+'</span>'+(desc?'<div class="check-desc">'+esc(desc)+'</div>':'')+'</div><span style="color:'+statusClr+'">'+esc(c.detail)+'</span></div>';}h+='</div></div></div>';h+='<div class="score-explainer"><div style="font-size:12px;color:var(--dim);text-transform:uppercase;letter-spacing:0.5px;margin-bottom:8px">Trust Score Formula</div><div style="display:grid;grid-template-columns:1fr 1fr;gap:4px 16px;font-size:12px"><div style="color:var(--muted)">Start</div><div style="color:var(--text);font-weight:600">100</div><div style="color:var(--muted)">Missing .gitignore</div><div style="color:var(--red)">-15</div><div style="color:var(--muted)">Unprotected .env</div><div style="color:var(--red)">-10</div><div style="color:var(--muted)">No lock file</div><div style="color:var(--amber)">-5</div><div style="color:var(--muted)">Security config</div><div style="color:var(--green)">+5 bonus</div></div></div>';h+='<div class="stats-grid">';h+=statCard(init.activeTools+'/'+init.totalTools,'Active Tools','var(--primary)');h+=statCard(init.advisoryCount,'Advisories',init.advisoryCount>0?'var(--amber)':'var(--green)');h+='</div>';h+='<h2 class="section-title">Project Info</h2><div class="card"><div class="hygiene-row"><span class="hygiene-label">Project</span><span>'+esc(init.projectName||'unnamed')+'</span></div><div class="hygiene-row"><span class="hygiene-label">Type</span><span>'+esc(init.projectType)+'</span></div><div class="hygiene-row"><span class="hygiene-label">Version</span><span>'+esc(init.projectVersion||'--')+'</span></div></div>';return h;}function renderIntegrity(){var guard=report.guardData;var h='<div class="section-intro">ConfigGuard signs your configuration files with SHA-256 hashes. If anyone (or any agent) modifies a signed file, the tampering is immediately detectable.</div>';var statusClr=guard.signatureStatus==='valid'?'var(--green)':guard.signatureStatus==='tampered'?'var(--red)':'var(--dim)';var statusLabel=guard.signatureStatus==='valid'?'Active':guard.signatureStatus==='tampered'?'Tampered':'Unsigned';h+='<div class="stats-grid">';h+=statCard(statusLabel,'Signature Status',statusClr);h+=statCard(guard.filesMonitored,'Files Monitored','var(--primary)');h+=statCard(guard.tamperedFiles?guard.tamperedFiles.length:0,'Tampered',(guard.tamperedFiles&&guard.tamperedFiles.length>0)?'var(--red)':'var(--green)');h+='</div>';if(guard.signatureStatus==='unsigned'){h+='<div class="cta-card"><div class="cta-title">ConfigGuard Not Active</div><div class="cta-desc">Sign your config files to detect unauthorized modifications.</div>'+cmdBlock('opena2a guard sign')+'</div>';}else if(guard.signatureStatus==='tampered'){h+='<h2 class="section-title">Tampered Files</h2><div class="card"><table class="data-table"><thead><tr><th>File</th><th>Status</th></tr></thead><tbody>';for(var i=0;i<guard.tamperedFiles.length;i++){h+='<tr><td>'+esc(guard.tamperedFiles[i])+'</td><td><span class="sev-badge sev-critical">tampered</span></td></tr>';}h+='</tbody></table></div><h2 class="section-title">Remediation</h2><div class="card">'+cmdBlock('opena2a guard diff')+'<p style="color:var(--muted);font-size:12px;margin:4px 0">Review changes, then resign:</p>'+cmdBlock('opena2a guard resign')+'</div>';}else{h+='<div class="card"><div class="empty-state">All '+guard.filesMonitored+' monitored files have valid signatures.</div></div>';}return h;}function renderShield(){var shield=report.shieldData;var h='<div class="section-intro">Shield is the unified security orchestration layer. It collects events from all OpenA2A tools into a tamper-evident log and classifies them into actionable findings.</div>';h+='<div class="stats-grid">';h+=statCard(shield.postureScore+'/100','Posture Score',scoreColor(shield.postureScore));h+=statCard(shield.eventCount,'Events (7d)','var(--primary)');h+=statCard(shield.classifiedFindings?shield.classifiedFindings.length:0,'Findings',shield.classifiedFindings&&shield.classifiedFindings.length>0?'var(--amber)':'var(--green)');h+=statCard(shield.policyLoaded?'Loaded':'None','Policy',shield.policyLoaded?'var(--green)':'var(--dim)');h+=statCard(shield.policyMode||'--','Mode','var(--muted)');h+=statCard(shield.integrityStatus||'healthy','Integrity',shield.integrityStatus==='healthy'?'var(--green)':'var(--red)');h+='</div>';var cf=shield.classifiedFindings||[];if(cf.length>0){h+='<h2 class="section-title">Classified Findings</h2><div class="card"><table class="data-table"><thead><tr><th>ID</th><th>Title</th><th>Severity</th><th>Count</th><th>Remediation</th></tr></thead><tbody>';for(var i=0;i<cf.length;i++){var f=cf[i];var badges='';if(f.finding.owaspAgentic)badges+='<span class="badge-owasp">'+esc(f.finding.owaspAgentic)+'</span>';if(f.finding.mitreAtlas)badges+='<span class="badge-mitre">'+esc(f.finding.mitreAtlas)+'</span>';h+='<tr><td>'+esc(f.finding.id)+'</td><td>'+esc(f.finding.title)+(badges?' '+badges:'')+'</td><td><span class="sev-badge sev-'+esc(f.finding.severity)+'">'+esc(f.finding.severity)+'</span></td><td>'+f.count+'</td><td>'+cmdBlock(f.finding.remediation)+'</td></tr>';if(f.finding.description)h+='<tr><td colspan="5" class="finding-desc">'+esc(f.finding.description)+'</td></tr>';}h+='</tbody></table></div>';}var arp=shield.arpStats;if(arp&&arp.totalEvents>0){h+='<h2 class="section-title">Runtime Protection (ARP)</h2><div class="card"><div class="arp-grid"><div class="arp-stat"><div class="arp-stat-value">'+arp.totalEvents+'</div><div class="arp-stat-label">Total Events</div></div><div class="arp-stat"><div class="arp-stat-value" style="color:var(--amber)">'+arp.anomalies+'</div><div class="arp-stat-label">Anomalies</div></div><div class="arp-stat"><div class="arp-stat-value" style="color:var(--red)">'+arp.violations+'</div><div class="arp-stat-label">Violations</div></div><div class="arp-stat"><div class="arp-stat-value">'+arp.processEvents+'</div><div class="arp-stat-label">Process</div></div><div class="arp-stat"><div class="arp-stat-value">'+arp.networkEvents+'</div><div class="arp-stat-label">Network</div></div><div class="arp-stat"><div class="arp-stat-value">'+arp.enforcements+'</div><div class="arp-stat-label">Enforcements</div></div></div></div>';}else{h+='<h2 class="section-title">Runtime Protection (ARP)</h2><div class="section-intro">ARP monitors process spawns, network connections, and file access in real time.</div><div class="card"><div class="empty-state">No ARP events in the last 7 days. Start runtime monitoring:</div>'+cmdBlock('opena2a runtime start')+'</div>';}if(!shield.policyLoaded){h+='<h2 class="section-title">Policy</h2><div class="cta-card"><div class="cta-title">No Security Policy</div><div class="cta-desc">Initialize Shield to enable adaptive security policy.</div>'+cmdBlock('opena2a shield init')+'</div>';}return h;}function renderHma(){var hma=report.hmaData;if(!hma||!hma.available){var h='<div class="section-intro">HackMyAgent runs 147 security checks against AI agent endpoints, testing for prompt injection, tool misuse, excessive agency, and OWASP Top 10 for LLM vulnerabilities.</div><div class="cta-card"><div class="cta-title">HackMyAgent Not Installed</div><div class="cta-desc">Install HMA to run comprehensive security scans against your AI agent.</div>'+cmdBlock('npm install -g hackmyagent')+'<p style="color:var(--muted);font-size:13px;margin-top:12px;text-align:center">Then re-run: <code style="color:var(--primary)">opena2a review</code></p></div>';return h;}var h='<div class="stats-grid">';h+=statCard(hma.score+'/100','HMA Score',scoreColor(hma.score));h+=statCard('Available','Status','var(--green)');h+='</div><div class="card"><div class="empty-state">HMA is available. Run a full scan for detailed results:</div>'+cmdBlock('opena2a scan --deep')+'</div>';return h;}function renderShadowAi(){var data=report.detectData;if(!data)return '<div class="card"><div class="empty-state">Shadow AI detection data not available.</div></div>';var capDescs={'filesystem':'Can read and write files','shell-access':'Can run commands on this computer','database':'Can read and modify databases','network':'Can make requests to external services','browser':'Can control a web browser','source-control':'Can access code repositories','messaging':'Can send messages','payments':'Can access payment systems','cloud-services':'Can access cloud infrastructure'};var h='<div class="section-intro">Shadow AI detection discovers AI agents running on this machine, MCP servers configured across all platforms, and AI configuration files in the project. It assesses governance posture and identifies gaps in identity, behavioral rules, and capability policies.</div>';var govScore=data.governanceScore;h+='<div class="stats-grid">';h+=statCard(govScore+'/100','Governance Score',scoreColor(govScore));h+=statCard(data.agents?data.agents.length:0,'AI Agents','var(--primary)');h+=statCard(data.mcpServers?data.mcpServers.length:0,'MCP Servers','var(--primary)');h+=statCard(data.aiConfigs?data.aiConfigs.length:0,'AI Configs','var(--primary)');h+='</div>';h+=governanceBanner(govScore,data.recoverablePoints);var agents=data.agents||[];var mcpServers=data.mcpServers||[];if(agents.length>0||mcpServers.length>0){h+='<h2 class="section-title">What This Means</h2><div class="card">';if(agents.length>0){var governed=0;for(var i=0;i<agents.length;i++){if(agents[i].governanceStatus==='governed')governed++;}var ungoverned=agents.length-governed;if(ungoverned===0){h+='<p style="color:var(--muted);font-size:13px;line-height:1.6;margin-bottom:8px">Your '+(agents.length===1?'AI agent has':'AI agents have')+' governance in place. Actions are bounded by the rules you defined.</p>';}else if(governed>0){h+='<p style="color:var(--muted);font-size:13px;line-height:1.6;margin-bottom:8px">'+agents.length+' AI tool'+(agents.length!==1?'s are':' is')+' running on this machine. '+governed+' '+(governed===1?'has':'have')+' governance rules, '+ungoverned+' '+(ungoverned===1?'does':'do')+' not.</p>';}else{h+='<p style="color:var(--muted);font-size:13px;line-height:1.6;margin-bottom:8px">'+agents.length+' AI tool'+(agents.length!==1?'s are':' is')+' running without governance. There are no documented rules limiting what '+(agents.length===1?'it':'they')+' can do in this project.</p>';}}if(mcpServers.length>0){var verified=0;for(var i=0;i<mcpServers.length;i++){if(mcpServers[i].verified)verified++;}var unverified=mcpServers.length-verified;h+='<p style="color:var(--muted);font-size:13px;line-height:1.6;margin-bottom:8px">'+mcpServers.length+' MCP server'+(mcpServers.length!==1?'s give':' gives')+' your AI agents additional capabilities (file access, database queries, API calls, etc.).</p>';if(unverified>0&&verified>0){h+='<p style="color:var(--muted);font-size:13px;line-height:1.6;margin-bottom:8px">'+verified+' '+(verified===1?'has':'have')+' verified identities, '+unverified+' '+(unverified===1?'does':'do')+' not.</p>';}else if(unverified===mcpServers.length){h+='<p style="color:var(--muted);font-size:13px;line-height:1.6;margin-bottom:8px">None have verified identities, so there is no tamper-evident record of which server version is installed.</p>';}}h+='</div>';}h+='<h2 class="section-title">Running AI Agents</h2>';if(agents.length===0){h+='<div class="card"><div class="empty-state">No AI agents detected on this machine.</div></div>';}else{h+='<div class="card"><table class="data-table"><thead><tr><th>Name</th><th>Identity</th><th>Governance</th></tr></thead><tbody>';for(var i=0;i<agents.length;i++){var a=agents[i];var idClr=a.identityStatus==='identified'?'var(--green)':'var(--medium)';var govClr=a.governanceStatus==='governed'?'var(--green)':'var(--medium)';h+='<tr><td>'+esc(a.name)+'</td><td style="color:'+idClr+'">'+esc(a.identityStatus)+'</td><td style="color:'+govClr+'">'+esc(a.governanceStatus)+'</td></tr>';}h+='</tbody></table></div>';}h+='<h2 class="section-title">MCP Servers</h2>';if(mcpServers.length===0){h+='<div class="card"><div class="empty-state">No MCP server configurations found.</div></div>';}else{var projectMcp=[];var globalMcp=[];for(var i=0;i<mcpServers.length;i++){if(mcpServers[i].source.indexOf('(project)')>=0)projectMcp.push(mcpServers[i]);else globalMcp.push(mcpServers[i]);}if(projectMcp.length>0){h+='<div class="card"><div class="card-title">Project-local ('+projectMcp.length+')</div><table class="data-table"><thead><tr><th>Name</th><th>Transport</th><th>Verified</th><th>Capabilities</th><th>Risk</th></tr></thead><tbody>';for(var i=0;i<projectMcp.length;i++){var s=projectMcp[i];var verStr=s.verified?'<span style="color:var(--green)">verified</span>':'<span style="color:var(--dim)">no</span>';var realCaps=(s.capabilities||[]).filter(function(c){return c!=='unknown';});var capsHtml='';for(var j=0;j<realCaps.length;j++){var desc=capDescs[realCaps[j]]||realCaps[j];capsHtml+='<div style="font-size:11px;color:var(--muted);margin:1px 0">'+esc(desc)+'</div>';}if(realCaps.length===0)capsHtml='<span style="color:var(--dim)">--</span>';h+='<tr><td>'+esc(s.name)+'</td><td>'+esc(s.transport)+'</td><td>'+verStr+'</td><td>'+capsHtml+'</td><td><span class="sev-badge sev-'+esc(s.risk)+'">'+esc(s.risk)+'</span></td></tr>';}h+='</tbody></table></div>';}if(globalMcp.length>0){h+='<div class="card"><div class="card-title">Machine-wide ('+globalMcp.length+')</div><table class="data-table"><thead><tr><th>Name</th><th>Source</th><th>Transport</th><th>Capabilities</th><th>Risk</th></tr></thead><tbody>';for(var i=0;i<globalMcp.length;i++){var s=globalMcp[i];var realCaps=(s.capabilities||[]).filter(function(c){return c!=='unknown';});var capsHtml='';for(var j=0;j<realCaps.length;j++){var desc=capDescs[realCaps[j]]||realCaps[j];capsHtml+='<div style="font-size:11px;color:var(--muted);margin:1px 0">'+esc(desc)+'</div>';}if(realCaps.length===0)capsHtml='<span style="color:var(--dim)">--</span>';h+='<tr><td>'+esc(s.name)+'</td><td style="font-size:11px;color:var(--dim)">'+esc(s.source)+'</td><td>'+esc(s.transport)+'</td><td>'+capsHtml+'</td><td><span class="sev-badge sev-'+esc(s.risk)+'">'+esc(s.risk)+'</span></td></tr>';}h+='</tbody></table></div>';}}var aiConfigs=data.aiConfigs||[];if(aiConfigs.length>0){h+='<h2 class="section-title">AI Config Files</h2><div class="card"><table class="data-table"><thead><tr><th>File</th><th>Tool</th><th>Risk</th><th>Details</th></tr></thead><tbody>';for(var i=0;i<aiConfigs.length;i++){var c=aiConfigs[i];var highlight=c.risk==='critical'||c.risk==='high';var rowStyle=highlight?'background:rgba(239,68,68,0.04)':'';h+='<tr style="'+rowStyle+'"><td>'+esc(c.file)+'</td><td>'+esc(c.tool)+'</td><td><span class="sev-badge sev-'+esc(c.risk)+'">'+esc(c.risk)+'</span></td><td style="font-size:12px;color:var(--muted)">'+esc(c.details)+'</td></tr>';}h+='</tbody></table></div>';}var findings=data.findings||[];if(findings.length>0){h+='<h2 class="section-title">Findings</h2>';for(var i=0;i<findings.length;i++){var f=findings[i];h+='<div class="card" style="margin-bottom:8px"><div style="display:flex;align-items:center;gap:8px;margin-bottom:8px"><span class="sev-badge sev-'+esc(f.severity)+'">'+esc(f.severity)+'</span><span style="font-size:14px;font-weight:600">'+esc(f.title)+'</span></div><p style="color:var(--muted);font-size:13px;line-height:1.6;margin-bottom:10px">'+esc(f.whyItMatters)+'</p>'+cmdBlock(f.remediation)+'</div>';}}if(agents.length===0&&mcpServers.length===0&&aiConfigs.length===0&&findings.length===0){h+='<div class="card"><div class="empty-state">No shadow AI detected. Your project has full governance coverage.</div></div>';}return h;}renderPage('overview');})();
 </script>
 </body>
 </html>`;

package/dist/report/review-html.js.map

@@ -1 +1 @@
-{"version":3,"file":"review-html.js","sourceRoot":"","sources":["../../src/report/review-html.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;AAUH,gDA2jBC;AAjkBD,SAAS,GAAG,CAAC,CAA4B;IACvC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACxE,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC;AAED,SAAgB,kBAAkB,CAAC,MAAoB;IACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEhE,OAAO;;;;;mCAK0B,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,SAAS,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0FAyHmB,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,CAAC;;+BAEtG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC;;;;;;;;;;;;;;;;;;;mDAmBD,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAoanD,CAAC;AACT,CAAC"}
+{"version":3,"file":"review-html.js","sourceRoot":"","sources":["../../src/report/review-html.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;AAUH,gDA2IC;AAjJD,SAAS,GAAG,CAAC,CAA4B;IACvC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACxE,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC;AAED,SAAgB,kBAAkB,CAAC,MAAoB;IACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEhE,OAAO;;;;;mCAK0B,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,SAAS,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0FAuGmB,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,CAAC;;+BAEtG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC;;;;;;;;;;;;;;;;;;;;mDAoBD,QAAQ;;;;;QAKnD,CAAC;AACT,CAAC"}

package/dist/util/report-submission.d.ts

@@ -21,6 +21,7 @@ export interface ScanFinding {
     filePath?: string;
     lineNumber?: number;
     autoFixable?: boolean;
+    attackClass?: string;
 }
 export interface ScanReport {
     /** Package name being scanned */